Product
Critical RCE and Information Disclosure Vulnerability in Gitea
1 TTP 1 CVEGitea contains a critical vulnerability allowing remote, unauthenticated attackers to execute arbitrary code and gain unauthorized access to sensitive information.
Gitea Remote Code Execution Vulnerability
1 TTPA vulnerability in Gitea allows a remote, unauthenticated attacker to execute arbitrary code, which could lead to full compromise of the affected Gitea instance and potentially the underlying server.
Gitea Docker Images Insecure Default Allows User Impersonation via X-WEBAUTH-USER
1 rule 2 TTPs 1 CVEGitea Docker images ship with a critical misconfiguration, CVE-2026-20896, where `REVERSE_PROXY_TRUSTED_PROXIES = *` by default, enabling any client to bypass authentication and impersonate users via the `X-WEBAUTH-USER` HTTP header when reverse proxy authentication is enabled, leading to unauthorized access to user accounts, including administrative ones.
Gitea Repository Migration SSRF and Internal Git Repository Exfiltration
2 rules 9 TTPs 1 CVEA critical vulnerability in Gitea allows an authenticated, low-privileged user to exfiltrate internal Git repositories by exploiting a validation bypass, where Gitea's initial URL validation for repository migration is circumvented by the Git command-line client's default behavior of following HTTP redirects to otherwise blocked internal IP addresses, leading to server-side request forgery (SSRF) and the theft of sensitive code, credentials, and configuration into an attacker-controlled repository, with persistent exfiltration possible through pull mirrors.
Gitea: Multiple Vulnerabilities
2 TTPsAn anonymous, remote attacker can exploit multiple vulnerabilities in Gitea to manipulate data or trigger a denial of service.
Gitea: Multiple Vulnerabilities Leading to XSS, Info Disclosure, and File Manipulation
4 TTPsAn attacker can exploit multiple unpatched vulnerabilities in Gitea to bypass security measures, disclose sensitive information, perform Cross-Site Scripting (XSS) attacks, and manipulate files, posing a high risk to self-hosted Git instances.
Gitea Security Bypass Vulnerability
1 TTPA remote, unauthenticated attacker can exploit a vulnerability in Gitea to bypass existing security measures, potentially leading to unauthorized access, privilege escalation, or data manipulation within the application.
Gitea Unauthenticated Container Registry Access (CVE-2026-27771)
2 rules 1 TTP 1 CVE 2 IOCsA vulnerability in Gitea's built-in container registry (CVE-2026-27771) allows unauthenticated attackers to pull private container images, potentially exposing source code, secrets, and production infrastructure details, affecting over 30,000 deployments.