CVE-2021-45327: Capture-replay in Gitea
Summary
CVE-2021-45327: Capture-replay in Gitea. Affects github.com/go-gitea/gitea versions < 1.11.2. Fixed in 1.11.2. How to fix ↓
Also tracked for
- code.gitea.io/gitea · Go
- gitea · Bitnami
The same CVE-2021-45327 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is a self-hosted Git service that allows users to set up their own Git repositories. It is built using the Go programming language and provides a range of features for managing and collaborating on code. Gitea versions prior to 1.11.2 are affected by a vulnerability that involves trusting HTTP permission methods on the server side when referencing the vulnerable admin or user API. This vulnerability could be exploited by a remote malicious user to execute arbitrary code.
Vulnerability Detail
The vulnerability in Gitea arises from the improper handling of HTTP permission methods on the server side. When interacting with the admin or user API, the server fails to properly validate the HTTP methods used, allowing an attacker to perform a capture-replay attack. By replaying a captured request with a different HTTP method, an attacker can bypass the intended access controls and execute arbitrary code on the server. This can lead to unauthorized access, data manipulation, and potentially compromise the entire system.
How To Fix
Latest published version: v1.8.3 as of 23 Oct 2026
go get github.com/go-gitea/gitea@v1.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.2
This is the first release that contains the fix.
go get github.com/go-gitea/gitea@v1.11.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to Gitea version 1.11.2 or later.
Conclusion
The vulnerability in Gitea allows for capture-replay attacks, enabling remote malicious users to execute arbitrary code. To mitigate this vulnerability, it is essential to upgrade to Gitea version 1.11.2 or later. Failure to address this vulnerability could result in unauthorized access, data manipulation, and compromise of the entire Gitea system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/go-gitea/gitea →
FAQ
Gitea is a self-hosted Git service that allows users to set up their own Git repositories. It provides a user-friendly interface and a range of features for managing and collaborating on code.
A capture-replay attack is a type of attack where an attacker captures a legitimate request and replays it with malicious modifications. In the case of this vulnerability, an attacker can capture a request to the admin or user API and replay it with a different HTTP method to bypass access controls and execute arbitrary code.
This vulnerability can lead to unauthorized access, data manipulation, and potentially compromise the entire Gitea system. An attacker could execute arbitrary code on the server, gaining control over the Git repositories and potentially accessing sensitive information.
To fix this vulnerability, you should upgrade your Gitea installation to version 1.11.2 or later. This version includes the necessary patches to mitigate the capture-replay vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to apply the official fix by upgrading to Gitea version 1.11.2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-gitea/gitea.
