Remote Code Execution Vulnerability in Gitea by Gitea Cloud
CVE-2026-104636

7.5HIGH

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
6 October 2026

What is CVE-2026-104636?

Gitea has a significant vulnerability that allows remote code execution through manipulated HTTP redirects. While validating the initial URLs for various operations, Gitea's Git client fails to revalidate these URLs after the initial checks, enabling a repository administrator with access to policy-allowed redirects to potentially exploit this mechanism. This could lead to unauthorized requests being sent to blocked addresses, depending on internal service configurations and security policies. Organizations using Gitea should review their settings and apply necessary updates to safeguard against this issue.

Affected Version(s)

Gitea 0 <= 1.27.3

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/39426
patch
https://blog.gitea.com/release-of-28.0.0/
release-notes

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/ihopenre-eng
https://github.com/ElectQ
https://github.com/TheFox0x7
https://github.com/silverwind
https://github.com/bircni
https://github.com/wxiaoguang
.