Is Gitea 1.27.3 affected?

Vulnerabilities affecting 1.27.3

• 9.9
  CVE-2026-73802 gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled fixed in 3.0.0
• 9.1
  CVE-2026-103059 Built-in SSH server auth bypass via case-insensitive LIKE key lookup
• 9.0
  CVE-2026-95106 Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one
• 9.0
  CVE-2026-103667 Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)
• 9.0
  CVE-2026-104626 Cancelled fork-PR Actions jobs are revived by later approval
• 9.0
  CVE-2026-104632 Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun
• 8.7
  CVE-2026-94205 Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull request author)
• 8.5
  CVE-2026-96594 Stored XSS via Repository Media API
• 8.5
  CVE-2026-89430 Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories
• 8.5
  CVE-2026-101029 Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings
• 8.1
  CVE-2026-104627 Cross-Session OpenID Credential Linking Enables Account Takeover
• 8.1
  CVE-2026-97208 Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy
• 8.1
  CVE-2026-96404 Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification
• 7.7
  CVE-2026-101027 SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS
• 7.5
  CVE-2026-109553 VerifyCert maps SSH certificate principals onto other users' SSH public keys
• 7.1
  CVE-2026-86684 Push-mirror API checks local-path permission on the repository owner instead of the caller
• 7.1
  CVE-2026-96399 Uncaught Exception and Out-of-bounds Read results in Gitea crash
• 6.5
  CVE-2026-110324 Private profile information leaks on POST request
• 6.5
  CVE-2026-105964 Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS
• 6.5
  CVE-2026-104633 A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenticated request
• 6.5
  CVE-2026-105267 POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs
• 6.5
  CVE-2026-58418 SSRF via HTTP Redirect in Repository Migration
• 6.3
  CVE-2026-110494 Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases
• 5.4
  CVE-2026-89182 Gitea push-to-create ignores ForcePrivate server policy, allowing non-admin users to publish repositories as public
• 5.3
  CVE-2026-105661 Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users
• 4.3
  CVE-2026-110311 Draft releases include attachment metadata from other repositories
• 4.3
  CVE-2026-107686 Locked issues and comments still accept reactions through the web UI
• 4.3
  CVE-2026-105268 Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments
• 4.3
  CVE-2026-104636 Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches
• 4.3
  CVE-2026-96400 Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false
• 4.3
  CVE-2026-96589 Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access
• 3.5
  CVE-2026-97204 DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels
• low
  CVE-2026-107618 Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`
• medium
  CVE-2026-97626 Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs
• medium
  CVE-2026-101023 OAuth access tokens can be exchanged as refresh tokens
• medium
  CVE-2026-95112 Algorithmic Complexity DoS in Issue Reference Parsing
• medium
  CVE-2026-103504 API team demotion does not reset unit permissions
• medium
  CVE-2026-79960 Deploy keys impersonate the repository owner in the hook pipeline
• high
  CVE-2026-70357 Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection
• medium
  CVE-2026-96580 Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation
• high
  CVE-2026-103670 Unapproved fork PR cancels trusted in-progress runs via run-level concurrency

Newer releases