CVE-2021-45326: Cross Site Request Forgery in Gitea
Summary
CVE-2021-45326: Cross Site Request Forgery in Gitea. Affects github.com/go-gitea/gitea versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Also tracked for
- gitea · Bitnami
The same CVE-2021-45326 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service written in Go. It provides a lightweight interface for managing repositories, users, and organizations. Gitea allows users to collaborate on code, track changes, and manage projects effectively. However, a vulnerability has been discovered in Gitea before version 1.5.2 that exposes it to Cross Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The Cross Site Request Forgery (CSRF) vulnerability in Gitea allows malicious actors to trick authenticated users into performing unintended actions on their behalf. By exploiting this vulnerability, an attacker can craft a malicious website or send a specially crafted link to a victim. When the victim visits the website or clicks the link while authenticated in Gitea, the attacker can perform state-altering actions on behalf of the victim, such as modifying repositories, creating or deleting files, or even gaining administrative access. This vulnerability can have severe consequences, especially when state-altering POST requests are involved.
How To Fix
Latest published version: v1.8.3 as of 23 Oct 2026
go get github.com/go-gitea/gitea@v1.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.2
This is the first release that contains the fix.
go get github.com/go-gitea/gitea@v1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version as soon as possible to mitigate the risk of CSRF attacks.
Conclusion
The Cross Site Request Forgery (CSRF) vulnerability in Gitea before version 1.5.2 exposes authenticated users to the risk of unintended actions performed by malicious actors. To mitigate this vulnerability, it is crucial to upgrade Gitea to version 1.5.2 or later. This upgrade will ensure that proper CSRF protection mechanisms are in place, safeguarding users from CSRF attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/go-gitea/gitea →
FAQ
Gitea is an open-source self-hosted Git service written in Go. It provides a lightweight interface for managing repositories, users, and organizations.
Cross Site Request Forgery (CSRF) is a type of attack where an attacker tricks an authenticated user into performing unintended actions on a web application. In the context of Gitea, it means that an attacker can perform actions on behalf of an authenticated user without their knowledge or consent.
This vulnerability can allow an attacker to perform unauthorized actions on behalf of an authenticated user. They can modify repositories, create or delete files, and potentially gain administrative access. The impact depends on the permissions and privileges of the targeted user.
To fix this vulnerability, it is recommended to upgrade Gitea to version 1.5.2 or later. This version includes the necessary fixes and CSRF protection mechanisms to prevent such attacks.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the only recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-gitea/gitea.
