Gitea Vulnerabilities Allow Bypass, Data Manipulation, Disclosure

CERT-Bund has released a security advisory (WID-SEC-2026-0737) concerning multiple vulnerabilities in Gitea, a popular open-source GitHub clone. The vulnerabilities, rated with a high CVSS base score of 7.3, allow remote attackers to bypass security controls, manipulate data, disclose confidential information, and potentially cause denial-of-service conditions. The advisory specifically affects Gitea versions prior to 1.25.5 across various operating systems including Linux, UNIX, and Windows.

Organizations utilizing Gitea should immediately update their instances to version 1.25.5 or a later release to mitigate these risks. Failure to apply the update could expose systems to data breaches, manipulation, and other security compromises. While no specific compliance deadline is mentioned, prompt patching is critical for maintaining data integrity and security.