Vulnerability GO-2026-6347
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 month ago
September 10, 2026 at 02:48 PM UTC
Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea
v0.9.99 - v1.25.4
v0.9.99 - v1.25.4
Summary
Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea
Details
Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
1 month ago
Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6343
v0.9.99 - v1.25.4 GO-2026-6343
Unknown
1 month ago
Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6344
v0.9.99 - v1.25.4 GO-2026-6344
Unknown
1 month ago
Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6345
v0.9.99 - v1.25.4 GO-2026-6345
Unknown
1 month ago
Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea
v0.9.99 - v1.26.0-rc0 GO-2026-6346
v0.9.99 - v1.26.0-rc0 GO-2026-6346
Unknown
1 month ago
Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev
v1.17.0 - v1.28.0-dev GO-2026-6433
v1.17.0 - v1.28.0-dev GO-2026-6433
Impacted packages
Timeline
Published
1 month ago
September 10, 2026 at 02:48 PM UTC
Fixed (v1.25.5)
7 months ago
March 13, 2026 at 01:26 AM UTC
Last Modified
1 month ago
September 10, 2026 at 03:15 PM UTC