Gitea (< 1.22.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gitea--1.22.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 24 Sep 2026 14:00:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgInformation Disclosure Vulnerability in Giteahttps://feed.craftedsignal.io/briefs/2026-09-gitea-info-disclosure/Thu, 24 Sep 2026 14:00:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-gitea-info-disclosure/A vulnerability in Gitea allows a remote, unauthenticated attacker to exploit an information disclosure flaw, potentially exposing sensitive repository or system data.A security vulnerability exists in Gitea versions prior to 1.22.6, which permits a remote, unauthenticated attacker to perform information disclosure. This flaw enables unauthorized access to repository data or internal system information that should otherwise be restricted. Defenders should prioritize patching to Gitea version 1.22.6 or later to mitigate the risk of data leakage.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to access sensitive internal data, potentially leading to the exposure of proprietary source code, credentials, or metadata stored within the Gitea instance. The scope of impact affects any organization hosting Gitea instances vulnerable to this specific information disclosure flaw.

Recommendation

  • Patch Gitea to version 1.22.6 or later immediately.
  • Audit access logs for unusual patterns of unauthenticated requests targeting repository metadata or configuration endpoints.
]]>mediumadvisory