Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-58314

  CVE-2026-58314: Gitea SSRF via Incomplete IP Classifier and Unguarded OpenID Discovery

  Gitea's outbound HTTP filter lets requests reach CGNAT addresses (used by Tailscale, AWS, and Kubernetes) that Go's standard library does not classify as private, and the OpenID login form fetches…

• criticalCVE-2026-20896

  CVE-2026-20896: Gitea Docker Image Authentication Bypass via Spoofed X-WEBAUTH-USER Header

  The official Gitea Docker image hard-codes a wildcard trusted-proxy setting that lets any client impersonate any Gitea user, including admins, with a single HTTP header and no password.

• highCVE-2026-58421

  CVE-2026-58421: Gitea CODEOWNERS ReDoS via Unbounded regexp2 Match

  Gitea lets any registered user crash a server by putting a catastrophic regex pattern in a CODEOWNERS file and opening a pull request with a crafted file name, hanging the database connection pool…

• highCVE-2026-55987

  CVE-2026-55987: Gitea OAuth2 Sign-In Reactivates Admin-Deactivated Accounts

  Signing in to Gitea via GitHub OAuth2 (or any OAuth2/OIDC source that does not issue refresh tokens) silently restores an account that an administrator deliberately deactivated, giving the user a…

• highCVE-2026-58437

  CVE-2026-58437: Gitea Repository Visibility Manipulation via Git Push Options

  Any user with admin or owner access to a Gitea repository can silently toggle its visibility from private to public using a standard git push flag, leaving no audit trail or webhook event behind.

• highCVE-2026-58423

  CVE-2026-58423: Gitea LFS SSH Sub-Verb Authentication Bypass

  Any registered Gitea user can pass a nonsense word instead of 'upload' or 'download' over SSH to trick the server into handing out a valid LFS token for private repositories they have no access to.

• highCVE-2026-58424

  CVE-2026-58424: Gitea Actions Fork PR Approval Gate Permanent Bypass

  A one-time approval click on a fork pull request permanently disables Gitea's workflow approval gate for that contributor, letting them run arbitrary CI code on the maintainer's runner without ever…

• criticalCVE-2026-58426

  CVE-2026-58426: Gitea Actions Artifacts V4 HMAC Signature Ambiguity

  A flaw in how Gitea signs V4 artifact URLs lets an attacker holding a valid signed URL rewrite it to access a different task or private repository without breaking the HMAC, enabling unauthorized…

• highCVE-2026-54481

  CVE-2026-54481: Gitea Internal API Client Skips TLS Verification

  Gitea's internal API HTTP client unconditionally trusts any TLS certificate, letting an attacker on the network intercept the high-privilege internal token and take full control of the Gitea server.

• highCVE-2026-58439

  CVE-2026-58439: Gitea Branch Protection Bypass via PR Retargeting

  A Gitea user with write access can get a pull request approved against an unprotected branch, then silently redirect that PR to a protected branch, and merge it without any legitimate approver ever…

• criticalCVE-2026-56750

  CVE-2026-56750: Gitea Remember-Me Token Theft Leaves Attacker Session Alive

  Stealing a Gitea Remember-Me cookie and using it once gives an attacker a permanently valid session, even after the real user logs back in and their original cookie is rejected.

• highCVE-2026-56755

  CVE-2026-56755: Gitea Debian Package Registry Denial of Service via Decompression Bomb and O(N^2) String Concatenation

  Uploading a crafted .deb file to Gitea's package registry causes the server to decompress up to 16 GB of data into memory and perform quadratic string work, crashing the process with a single…