Changeflow GovPing Data Privacy & Cybersecurity Gitea Multiple Vulnerabilities - Info Disclosur...
Priority review Notice Added Final

Gitea Multiple Vulnerabilities - Info Disclosure and XSS, CVSS 7.5

Favicon for wid.cert-bund.de CERT-Bund Security Advisories
Published
Detected
Email

Summary

CERT-Bund published a security advisory (WID-SEC-2026-1172) detailing multiple vulnerabilities in Open Source Gitea prior to version 1.26.0. The vulnerabilities carry a CVSS Base Score of 7.5 (high) and a Temporal Score of 6.5 (medium), with remote attack capability confirmed. Attackers can exploit these flaws to disclose information, bypass security measures, and conduct Cross-Site Scripting (XSS) attacks. Gitea is an open-source GitHub clone running on Linux, UNIX, Windows, and other platforms.

“Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um einen Cross-Site Scripting Angriff durchzuführen.”

Published by CERT-Bund on wid.cert-bund.de . Detected, standardized, and enriched by GovPing. Review our methodology and editorial standards .
View original document View source feed page

What changed

CERT-Bund published a security advisory identifying multiple vulnerabilities in Gitea prior to version 1.26.0. The vulnerabilities have a CVSS Base Score of 7.5 (high) and enable remote attackers to disclose information, bypass security measures, and perform Cross-Site Scripting attacks. The CVSS Temporal Score is 6.5 (medium).

Organizations running Gitea should assess whether they are using a version below 1.26.0 and apply the vendor's mitigation measures promptly. Since Gitea is used for code repository hosting, a compromise could affect the confidentiality and integrity of source code and development workflows.

What to do next

  1. Contact vendor for mitigation information

Archived snapshot

Apr 20, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

[WID-SEC-2026-1172] Gitea: Mehrere Schwachstellen CVSS Base Score 7.5 (hoch) CVSS Temporal Score 6.5 (mittel) Remoteangriff ja Datum 19.04.2026 Stand 20.04.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

  • Linux
  • Sonstiges
  • UNIX
  • Windows

Produktbeschreibung

Gitea ist ein quelloffener Github-Klon.

Produkte

19.04.2026
- Open Source Gitea <1.26.0

Angriff

Angriff

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um einen Cross-Site Scripting Angriff durchzuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben

Related changes

Favicon for wid.cert-bund.de Langflow Multiple Vulnerabilities Allow File Manipulation, Information Disclosure, XSS
Priority review Apr 20, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Microsoft Developer Tools Multiple Vulnerabilities CVSS 7.8
Priority review Apr 17, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Multiple XSS Vulnerabilities Drupal Core, Severity Medium
Priority review Apr 17, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-Bund Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for wid.cert-bund.de
CERT-Bund Security Advisories wid.cert-bund.de/content/public/securityAdvisory/rss
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-Bund
Published
April 19th, 2026
Instrument
Notice
Branch
Executive
Source language
de
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
WID-SEC-2026-1172

Who this affects

Applies to
Technology companies
Industry sector
5112 Software & Technology
Activity scope
Vulnerability disclosure Cross-site scripting mitigation Information disclosure remediation
Geographic scope
Germany DE

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Topics
Data Privacy Software & Technology

Browse Categories

Agriculture & Food Safety 70 AI Regulation 3 Banking & Finance 357 Consumer Protection 76 Courts & Legal 361 Data Privacy & Cybersecurity 83 Defense & National Security 53 Dentistry 1 Education 49 Emergency Management 1 Energy 99 Environment 86 Environmental & Energy 50 Environmental Regulation 7 Financial Regulation 2 Financial Services 10 Gaming 1 Gaming & Gambling 1 Government & Legislation 278 Government Operations 124 Healthcare 136 Healthcare Compliance 6 Healthcare & Life Sciences 122 Housing 16 Immigration 8 Immigration & Border Control 2 Insurance 72 Intellectual Property 1 Labor & Employment 125 Law Enforcement 1 Legal & Judicial 42 Occupational Safety 2 Pharma & Drug Safety 101 Pharma & Healthcare 1 Pharmacy 1 Privacy 1 Professional Licensing 2 Public Health 2 Public Utilities 1 Real Estate 2 Real Estate & Housing 55 Sanctions & Export Controls 2 Securities & Investments 32 Securities & Markets 103 Securities Regulation 6 Tax 64 Tax & Revenue 10 Telecom & Technology 47 Trade & Commerce 3 Trade & Sanctions 135 Transportation 88 Veterinary Boards 4

Get alerts for this source

We'll email you when CERT-Bund Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!