CVE-2021-45330: Improper Privilege Management in Gitea
Summary
CVE-2021-45330: Improper Privilege Management in Gitea. Affects code.gitea.io/gitea versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Also tracked for
- gitea · Bitnami
The same CVE-2021-45330 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service written in Go. It provides a lightweight interface for managing repositories, users, and access control. Gitea versions up to 1.15.7 are affected by an improper privilege management vulnerability. This vulnerability allows a malicious user to gain unauthorized privileges by exploiting the persistence of client-side cookies and the server-side session not being invalidated.
Vulnerability Detail
The vulnerability in Gitea arises from the failure to properly manage privileges. When a user logs out, the client-side cookies are not deleted, and the session remains valid on the server-side. This allows an attacker to reuse the session and gain unauthorized access to privileged actions. By exploiting this vulnerability, an attacker can perform actions that they should not have permission to perform, potentially leading to unauthorized data access, modification, or destruction.
How To Fix
Latest published version: v1.26.4 as of 22 Oct 2026
go get code.gitea.io/gitea@v1.26.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.0
This is the first release that contains the fix.
go get code.gitea.io/gitea@v1.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Gitea to address the issue.
Conclusion
The improper privilege management vulnerability in Gitea can lead to unauthorized privilege escalation and potential data breaches. It is crucial to upgrade to Gitea version 1.6.0 or later to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for code.gitea.io/gitea →
FAQ
Gitea is a self-hosted Git service written in Go. It provides a lightweight interface for managing repositories, users, and access control.
This vulnerability allows a malicious user to gain unauthorized privileges in Gitea. They can perform actions that they should not have permission to perform, potentially leading to unauthorized data access, modification, or destruction.
To fix this vulnerability, it is recommended to upgrade to Gitea version 1.6.0 or later. This ensures that client-side cookies are properly deleted upon logout, and server-side sessions are invalidated.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of Gitea to address the issue.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-pg38-r834-g45j/GHSA-pg38-r834-g45j.json
References
Related vulnerabilities
Recent vulnerabilities recorded for code.gitea.io/gitea.
