12 KiB
12 KiB
Gitea
LAB ONLY|AUTHORIZED TARGETS ONLY| 自动生成索引
- 系统 ID:
gitea - 分类:
platforms - 覆盖策略:
rolling-24m - 总案例数:
37 - 近 30 天新增/更新:
37 - 重点 Markdown 案例数:
37 - 已实证(真实版本):
0 - 已实证(synthetic):
0 - 阻塞数:
1 - 待人工/缺浏览器证据:
36 - 最近渲染时间:
2026-03-17T09:29:53+00:00
目标约束
- 适用目标类型:
lab-local, lab-public, authorized-third-party - 是否允许公网验证:
yes, but ownership or authorization is required - 授权前提: 资产归属可证明，或已取得书面/明确授权。
- 最小化验证方式: 最小化验证、只读探测、可审计回显、受控注入。
- 禁止场景: 无归属证明或无明确授权的公网目标；知名公共网站或与测试无关的第三方资产；会造成持久破坏、数据越权下载或不可回滚影响的动作
来源
officialGitHub Gitea Advisories (mode=core)officialOSV Gitea (mode=core)
案例列表
| 标题 | 严重度 | 案例状态 | 实证状态 | 实证方式 | 来源置信度 | 更新时间 | 案例页 |
|---|---|---|---|---|---|---|---|
| Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:54.518308Z |
link |
| Gitea has improper access control for uploaded attachments in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:53.977351Z |
link |
| Gitea does not properly validate project ownership in organization project operations in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:57.697708Z |
link |
| Gitea improperly exposes issue and pull request titles in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:54.012782Z |
link |
| Gitea improperly exposes issue titles and repository names through previously started stopwatches in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:54.692700Z |
link |
| Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:56.025932Z |
link |
| Gitea does not properly validate repository ownership when deleting Git LFS locks in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:55.339967Z |
link |
| Gitea does not properly validate ownership when toggling OpenID URI visibility in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:54.244003Z |
link |
| Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:55.747880Z |
link |
| Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:49.801641Z |
link |
| Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:49.095775Z |
link |
| Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea | unknown |
generated |
blocked-artifact |
real |
official |
2026-03-03T04:57:48.777563Z |
link |
| Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:50.087298Z |
link |
| Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:50.339953Z |
link |
| Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:49.781753Z |
link |
| Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:49.213758Z |
link |
| Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:50.526913Z |
link |
| Gitea: anonymous user can visit private user's project in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:51.457970Z |
link |
| Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:57:50.473303Z |
link |
| Gitea vulnerable to Argument Injection in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:52:41.181693Z |
link |
| Improper Privilege Management in Gitea in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:52:33.136607Z |
link |
| Gitea Remote Code Execution (RCE) in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:52:20.787387Z |
link |
| Denial of Service in Gitea in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:52:17.939867Z |
link |
| Cross-site Scripting in Gitea in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:52:18.307544Z |
link |
| Gitea Missing Authorization vulnerability in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:50:45.472605Z |
link |
| Stored Cross-site Scripting in gitea in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:50:45.577318Z |
link |
| Arbitrary file deletion in gitea in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:50:19.647131Z |
link |
| Shell command injection in gitea in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:50:23.949796Z |
link |
| Path Traversal in Gitea in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:50:06.638863Z |
link |
| Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:52:07.604662Z |
link |
| Capture-replay in Gitea in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:52:07.840324Z |
link |
| Gitea erroneous repo clones in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:54:07.076900Z |
link |
| Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:54:04.686907Z |
link |
| Gitea XSS Vulnerability in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:53:57.848904Z |
link |
| Gitea allowed assignment of private issues in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:55:04.505871Z |
link |
| Buffer Overflow in gitea in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:55:15.307648Z |
link |
| Gitea Open Redirect in code.gitea.io/gitea | unknown |
generated |
triage-manual |
synthetic |
official |
2026-03-03T04:51:49.844240Z |
link |