Gitea — PoC Archivehttps://poc.intelseclab.com/tags/gitea/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000Gitea — diffpatch API Git Hook Remote Code Execution (CVE-2026-60004)https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-60004-gitea-diffpatch-githook-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2026-60004-gitea-diffpatch-githook-rce/High severity (CVSS 8.8) — web · CVE-2026-60004. Status: Patched. Affects: Gitea (self-hosted Git service), diffpatch API endpoint, Git three-way merge fallback. Tags: gitea, git, diffpatch, git-hook, post-index-change, three-way-merge, bare-repository, CWE-94, authenticated-rce, self-hosted, code-hosting.webHighgiteagitdiffpatchgit-hookpost-index-changethree-way-mergebare-repositoryCWE-94authenticated-rceself-hostedcode-hostingGitea Docker Image Reverse-Proxy Authentication Bypass — "One Header, Any User" (CVE-2026-20896)https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-20896-gitea-docker-reverse-proxy-auth-bypass/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-20896-gitea-docker-reverse-proxy-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-20896 (GHSA-f75j-4cw6-rmx4). Status: Weaponized (public PoC + detector script, actively exploited in the wild per Sysdig). Affects: Gitea — official Docker images (gitea/gitea), both root and rootless variants. Tags: gitea, docker, authentication-bypass, reverse-proxy, header-spoofing, unauthenticated, remote, cwe-290, actively-exploited.webCriticalgiteadockerauthentication-bypassreverse-proxyheader-spoofingunauthenticatedremotecwe-290actively-exploitedGitea OAuth2 Scope Enforcement Bypass via HTTP Basic Auth — CVE-2026-28699https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-28699-gitea-oauth2-scope-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-28699-gitea-oauth2-scope-bypass/High severity — web · CVE-2026-28699. Status: PoC. Affects: Gitea (code.gitea.io/gitea). Tags: gitea, oauth2, scope-bypass, basic-auth, incorrect-authorization, cwe-863, api.webHighgiteaoauth2scope-bypassbasic-authincorrect-authorizationcwe-863apiGitea Container Registry Anonymous Auth Bypass (CVE-2026-27771)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27771-gitea-registry-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27771-gitea-registry-auth-bypass/Critical severity — web · CVE-2026-27771. Status: Weaponized. Affects: Gitea (self-hosted Git service with OCI container registry). Tags: gitea, forgejo, oci-registry, auth-bypass, container-registry, unauthenticated, information-disclosure.webCriticalgiteaforgejooci-registryauth-bypasscontainer-registryunauthenticatedinformation-disclosureGitea act_runner container.options Host Namespace Escapehttps://poc.intelseclab.com/pocs/cloud/2026-07-03_gitea-act-runner-container-options-escape/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-03_gitea-act-runner-container-options-escape/High severity — cloud · None assigned as of 2026-07-03. Status: PoC. Affects: Gitea Actions act_runner (Docker-backed). Tags: gitea, act-runner, ci-cd, docker, container-escape, host-namespace, privilege-escalation, capabilities.cloudHighgiteaact-runnerci-cddockercontainer-escapehost-namespaceprivilege-escalationcapabilities