Gitea Open Source Git Server — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in Gitea Open Source Git Server, with AI-generated Chinese analysis, references, and POCs.

Vendor: Gitea

CVE ID	Title	CVSS	Severity	Published
CVE-2026-20912	Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure CWE-284	7.5^AI	High^AI	2026-01-22
CVE-2026-20904	Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes CWE-284	4.3^AI	Medium^AI	2026-01-22
CVE-2026-20897	Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) CWE-284	6.5^AI	Medium^AI	2026-01-22
CVE-2026-20883	Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure CWE-284	5.3^AI	Medium^AI	2026-01-22
CVE-2026-20888	Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) CWE-284	4.3^AI	Medium^AI	2026-01-22
CVE-2026-20750	Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR) CWE-284	6.5^AI	Medium^AI	2026-01-22
CVE-2026-20800	Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation CWE-200	5.4^AI	Medium^AI	2026-01-22
CVE-2026-20736	Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check CWE-284	6.5^AI	Medium^AI	2026-01-22
CVE-2026-0798	Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation CWE-284	3.5^AI	Low^AI	2026-01-22
CVE-2024-6886	Inproper Sanitation of field leading to stored XSS CWE-79	5.4^AI	Medium^AI	2024-08-06

All 10 known CVE vulnerabilities affecting Gitea Open Source Git Server with full Chinese analysis, references, and POCs where available.