VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

code.gitea.io/gitea: vulnerability history, versions and safety

code.gitea.io/gitea is a package in the Go ecosystem. Vulert records 193 vulnerabilities for it across 120 releases, from Sep 2021 to Sep 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
193 vulnerabilities recorded C16 H36 M47 L10 U84
i
4 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
152 in the last 12 months

Most recent disclosure 10 Sep 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all code.gitea.io/gitea vulnerabilities

Vulert verdict on code.gitea.io/gitea v1.26.4 i

Updated on 23 Oct 2026

Careful: v1.26.4 has 179 known vulnerabilities, and 3 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.26.4 — affected i
  • Vulnerabilities on record 193 over 4 years · 152 in the last year i
  • Latest disclosure 10 Sep 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 4 i
  • Stars 58,625 i
  • OpenSSF scorecard 7/10 i
  • Last release 4 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for code.gitea.io/gitea, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.26.4 21 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260621122324-2bde4fa5d268 21 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260621122324-2bde4fa5d268 21 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.3 20 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260619215001-b0eaf6c75b2e 19 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.3-0.20260619215001-b0eaf6c75b2e 19 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260617204959-99f8b3d9a1d3 17 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260617204959-99f8b3d9a1d3 17 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260617201924-f6e2ca4388a5 17 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260617194515-61c58b4b6509 17 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260617194322-5facdcc7fd99 17 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260617194322-5facdcc7fd99 17 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260614195244-bb4cccc6e90f 14 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260610100523-617b6948b1ac 10 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260610073228-1c7b7ea72df7 10 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260606200706-8f4b7ebbf606 06 Jun 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260526090805-a03e0364ebd8 26 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260526090805-a03e0364ebd8 26 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260526060733-4a6db5a7c241 26 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260524060736-c044b0f48c76 24 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.2 20 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260520163427-552c29a2592d 20 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260520163427-552c29a2592d 20 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260518183642-f2a1271f1645 18 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260518065933-9c0ad8291b43 18 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260518050604-aecb2585f02c 18 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260518045208-c3d9d0770253 18 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260514124620-5c887d68cae6 14 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260513010944-f01953e764b5 13 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260511233449-6a2706626904 11 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260511173607-5eaa0bc6035b 11 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260510045146-a61598884f9d 10 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260508063023-7dc3087acd8c 08 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260507141945-c9b9e376fb50 07 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260501110003-02b1b8a5497c 01 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260501033443-48cea1fb79d8 01 May 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260430143805-81692ceafaa6 30 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260430010539-52d6baf5a816 30 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260429153733-926280362172 29 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260428210350-deec2b0929c5 28 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260427084559-331450b17a02 27 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260425192625-11f77efea55a 25 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.1 24 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260424153701-0277e3ebaa52 24 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260424130059-c5c9713ed47e 24 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260424063515-0817a405afe1 24 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260424000432-3b2fd9791c0a 24 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260423233341-899ede1d55f5 23 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260423183316-1af16679c397 23 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260423135831-12d83cbfa3ca 23 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260422205859-8cfcef32c613 22 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260419073750-16bdae53c812 19 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260418194239-9b9d1e31aa0b 18 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0 18 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260418193249-af31b9d433b4 18 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260417223017-d5831b9385eb 17 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260416173046-b1bfca39f15b 16 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260415172626-2644bb8490e7 15 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260413200129-0593b58ff77c 13 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260408204328-8bf3c8b79dcb 08 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-rc0 08 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev.0.20260408005516-03205d94da90 08 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.27.0-dev 07 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260402220443-686d10b7f0c2 02 Apr 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260326005331-ffa626b58522 26 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260325163748-bc5c55407234 25 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260322042613-0ab612f5abd9 22 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260319005044-79f96b3e2427 19 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260318231355-18c65965abea 18 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.25.5 13 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260313012058-2601f50026fd 13 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260312003733-156d9ffb239f 12 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260308143550-0724344a8a0c 08 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260308095946-3f1ef703d587 08 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260308095946-3f1ef703d587 08 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260308070428-a0996cb229ee 08 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260307204016-f7e3569fab57 07 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.25.5-0.20260307204016-f7e3569fab57 07 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260307204016-f7e3569fab57 07 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.25.5-0.20260306195017-f7ac5076711a 06 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260306195017-f7ac5076711a 06 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.25.5-0.20260306190250-e2517e0fa931 06 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260306190250-e2517e0fa931 06 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.25.5-0.20260306183320-413074b1e1dc 06 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260306183320-413074b1e1dc 06 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260306050044-f3bdcc58aff6 06 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260306000312-c710ce34fb94 06 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260305203057-833304ac15bc 05 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260305193134-99b0bf7324de 05 Mar 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260226191319-f7f55a356f39 26 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260226115602-d0f92cb0a133 26 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260225012107-2176e84ab977 25 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260222220907-e7fca90a780e 22 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.25.5-0.20260221002656-805105607571 21 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260221002656-805105607571 21 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260220214854-5ad87616c9c6 20 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260214120659-e927a86586af 14 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v0.0.0-20260210050956-09a88fb17ea2 10 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260208144305-f65df2a69be5 08 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260205055708-000d7c1ccb4d 05 Feb 2026 C15 H31 M46 L10 U77 MIT No Details →
v1.26.0-dev.0.20260128054207-bf8d11bb212b 28 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v1.26.0-dev.0.20260127004245-125257eacffa 27 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v1.26.0-dev.0.20260123202458-0f78b9999861 23 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v1.25.5-0.20260123053534-eb95bbc1fdd4 23 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v1.26.0-dev.0.20260122083002-5f91c51fa554 22 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v1.26.0-dev.0.20260122011706-6a5f9e12f908 22 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v1.25.4 22 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v1.26.0-dev.0.20260120213645-4cdb8a7f96af 20 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v1.26.0-dev.0.20260120180551-f6db180a8097 20 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v0.0.0-20260116051113-67e75f30a83d 16 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v1.26.0-dev.0.20260115013018-dfe4055b928b 15 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v1.26.0-dev.0.20260114193753-14e8c9b767d3 14 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v0.0.0-20260114172933-7b5de594cd92 14 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v0.0.0-20260114161122-8a98ac22131c 14 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v0.0.0-20260113131339-95ea2df00a70 13 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v0.0.0-20260113124429-ed5720af2ac9 13 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v0.0.0-20260113121357-e95c30eb8092 13 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v0.0.0-20260113103118-a0c77673ffb7 13 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v0.0.0-20260113043720-d96b68cbf5dc 13 Jan 2026 C15 H31 M46 L10 U77 — No Details →
v0.0.0-20260113040658-2859b0602aa0 13 Jan 2026 C15 H31 M46 L10 U77 — No Details →

The newest 120 of 3,342 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 1
  • 2022 15
  • 2023 3
  • 2024 22
  • 2025 18
  • 2026 134

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 152 of the 193 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for code.gitea.io/gitea

The 5 most severe of 193 vulnerabilities recorded for this package

Search all 193 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-26292: Gitea Package Vulnerability in LFS Mirror Operations Bypassing Migration Protections 9.8 critical 1.25.5 03 Jul 2026
CVE-2021-45330: Improper Privilege Management in Gitea 9.8 critical 1.6.0 10 Feb 2022
CVE-2021-45331: Reuse of one time passwords allowed in Gitea 9.8 critical 1.5.0 10 Feb 2022
CVE-2026-27780: Gitea Pre-Receive Hook Scanner Errors Allow Branch-Protection Bypass 9.8 critical 1.26.0 03 Jul 2026
CVE-2026-20896: Gitea Docker Image Vulnerability Allows User Impersonation via X-WEBAUTH-USER Header 9.8 critical 1.26.3 21 Jul 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About code.gitea.io/gitea

Is code.gitea.io/gitea safe to use?

Vulert records 193 vulnerabilities for code.gitea.io/gitea in Go: 16 critical, 36 high, 47 medium and 10 low, plus 84 not yet rated. 4 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is code.gitea.io/gitea's Vulert package health score?

Vulert scores code.gitea.io/gitea 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of code.gitea.io/gitea affected?

Yes. v1.26.4, the version you would install today, has 179 known vulnerabilities, and 3 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does code.gitea.io/gitea have?

193 vulnerabilities are recorded for code.gitea.io/gitea in the Go ecosystem: 16 critical, 36 high, 47 medium and 10 low, plus 84 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new code.gitea.io/gitea vulnerabilities disclosed?

152 vulnerabilities were recorded for code.gitea.io/gitea in the last 12 months, and the oldest entry in this database dates to 27 Sep 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of code.gitea.io/gitea are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor code.gitea.io/gitea for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the code.gitea.io/gitea version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.