Gitea用户信息泄露

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://avd.aliyun.com/detail?id=AVD-02021-0134
• https://www.sentinelone.com/vulnerability-database/cve-2026-0798/
• https://www.sentinelone.com/vulnerability-database/cve-2026-20800/
• https://github.com/go-gitea/gitea/issues/37435
• https://nvd.nist.gov/vuln/detail/CVE-2026-20800
• https://github.com/go-gitea/gitea/security/advisories/GHSA-g54m-9f6g-wj7q
• https://about.gitea.com/security
• https://github.com/go-gitea/gitea/issues/4417
• https://zhuanlan.zhihu.com/p/486410391
• https://blog.nsfocus.net/gitea-1-4-0-rce/

Related Vulnerabilities

• Gitea /api/v1/repos/diffpatch 代码执行漏洞（CVE-2026-60004）
• Gitea Org-mode 文件读取漏洞（CVE-2026-59774）
• PoCCVE-2026-20896: Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass
• PoCCVE-2026-59774: Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read
• PoCCVE-2026-60004: Gitea <= 1.27.0 - Pre-Auth Remote Code Execution
• PoCCVE-2026-27771: Gitea Container Registry - Unauthorized Private Image Access
• Gitea /v2/_catalog 未授权访问漏洞（CVE-2026-27771）
• gitea-forgejo存在身份认证绕过(CVE-2026-27771)
• PoCgitea-userenum: Gitea - User Enumeration
• PoCCVE-2021-45328: Gitea < 1.4.3 - Open Redirect
• PoCgitea-open-redirect-bypass: Gitea < 1.21.0 - Open Redirect
• PoCglitchtip-public-signup: Gitea Public Registration Enabled
• PoCgitea-public-repo-exposure: Gitea Public Repository - Exposure