CVE-2026-95106 – Gitea
“When your code platform trusts the wrong identity, every repository, runner, and release becomes someone else's to control.”
This Gitea update fixes eleven flaws in authentication, authorization, CI pipelines, and service stability. The most serious problems let attackers skip passkey checks, sign in over SSH as another user, extend OAuth2 access past its intended lifetime, and run fork-controlled workflow code on a project's own runners without approval. Others let users keep write access after a team is demoted, delete published releases, change repository visibility, push to internal services or local server paths, hide malicious content behind a harmless-looking diff, and crash the instance for all users.
CVE-2026-73278 and CVE-2026-94205 each have a CVSS score of 9.8, Critical severity. CVE-2026-101023, CVE-2026-103059, and CVE-2026-95106 each have a CVSS score of 9.1, Critical severity. CVE-2026-103504, CVE-2026-105267, and CVE-2026-89430 each have a CVSS score of 8.1, High severity. CVE-2026-96399 has a CVSS score of 7.5, High severity. CVE-2026-79960 and CVE-2026-86684 each have a CVSS score of 7.1, High severity.
Key Details
- Affected Product
- Gitea Gitea
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-706