Gitea

gitea.io
Awesome Privacy➔ Development➔ Code Hosting➔ Gitea
Gitea

Lightweight self-hosted git platform, written in Go.

Avoid

  • github
  • gitlab
  • bitbucket
  • sourceforge
  • aws codecommit

Also Consider

Open Source

Gitea Source Code

Author

go-gitea

Description

Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD

#bitbucket#cicd#devops#docker-registry-v2#git#git-gui#git-lfs#git-server#gitea#github#github-actions#gitlab#go#golang#hacktoberfest#maven-server#npm-registry#self-hosted#typescript#vue

Homepage

https://gitea.com

Repository

  • LicenseMIT
  • Created01 Nov 16
  • Primary languageGo
  • Size354,792 KB
  • Stars57,797
  • Forks7,102
  • Watchers57,797

Language Usage

Language Usage

Project Health

  • Last commit5 days ago
  • Open issues2,535
  • Latest releasev1.28.0-dev

Top Contributors

Recent Commits

  • Giteabot(03 Sept 26)

    fix(deps): update module golang.org/x/crypto to v0.56.0 [security] (#39219)

  • GiteaBot(03 Sept 26)

    [skip ci] Updated translations via Crowdin

  • Elisei Roca(02 Sept 26)

    fix(httplib): prevent leaking localhost:3000 in public links (#39217) Co-authored-by: wxiaoguang <[email protected]>

  • 开心(02 Sept 26)

    fix(pulls): hide branch deletion when an open PR uses the branch (#39193) Co-authored-by: wxiaoguang <[email protected]>

  • Mitrahsoft(02 Sept 26)

    enhance(repo): check full repo name for dangerous operations (#39213) Co-authored-by: wxiaoguang <[email protected]>

  • Giteabot(02 Sept 26)

    chore(deps): update dependency go to v1.27.1 (#39206)

  • GiteaBot(02 Sept 26)

    [skip ci] Updated translations via Crowdin

  • GiteaBot(01 Sept 26)

    [skip ci] Updated translations via Crowdin

  • wxiaoguang(31 Aug 26)

    fix: correct repo/attatchment absolute url and release layout (#39178)

  • aminoy(31 Aug 26)

    fix(setting): honor bare -1 for timeout settings (#39181) Co-authored-by: wxiaoguang <[email protected]>

  • silverwind(31 Aug 26)

    chore: remove dead CSS rules (#39188)

  • Harsh Satyajit Thakur(31 Aug 26)

    chore(webhook): GET method is not recommended (#39169) Co-authored-by: wxiaoguang <[email protected]>

  • wxiaoguang(31 Aug 26)

    fix: charset lookup (#39187)

  • Zhaoqi Xu(31 Aug 26)

    fix(git): keep IPv6 brackets in submodule web links (#39186) Co-authored-by: wxiaoguang <[email protected]>

  • silverwind(31 Aug 26)

    refactor: improve types in the frontend, misc fixes (#39142)

  • Giteabot(31 Aug 26)

    chore(deps): update dependencies (#39176)

  • GiteaBot(31 Aug 26)

    [skip ci] Updated translations via Crowdin

  • tara~ ♡(30 Aug 26)

    enhance(repo): unify diff stats on commit pages, misc diff tweaks (#39134) Co-authored-by: silverwind <[email protected]> Co-authored-by: wxiaoguang <[email protected]>

  • bircni(30 Aug 26)

    docs: Update CHANGELOG for release 1.27.3 (#39170)

  • GiteaBot(30 Aug 26)

    [skip ci] Updated translations via Crowdin

  • GiteaBot(30 Aug 26)

    [skip ci] Updated translations via Crowdin

  • Royce Remer(29 Aug 26)

    fix(process): reap entire process group on cmd.Cancel (#39143) Signed-off-by: Royce Remer <[email protected]> Co-authored-by: wxiaoguang <[email protected]>

  • Karthik Bhandary(29 Aug 26)

    feat(web): Add org removal functionality to admin user details page (#38013) Signed-off-by: techknowlogick <[email protected]> Signed-off-by: Karthik Bhandary <[email protected]> Co-authored-by: techknowlogick <[email protected]> Co-authored-by: bircni <[email protected]> Co-authored-by: wxiaoguang <[email protected]>

  • bircni(29 Aug 26)

    fix(actions): run every due schedule exactly once per occurrence (#39078) Signed-off-by: Lunny Xiao <[email protected]> Co-authored-by: silverwind <[email protected]> Co-authored-by: Lunny Xiao <[email protected]> Co-authored-by: wxiaoguang <[email protected]>

  • wxiaoguang(29 Aug 26)

    refactor: pagination/pager (#39162)

  • GiteaBot(29 Aug 26)

    [skip ci] Updated translations via Crowdin

  • Mitrahsoft(28 Aug 26)

    enhance(actions): make workflow dispatch choice dropdown support search (#39154) Co-authored-by: wxiaoguang <[email protected]>

  • Nitish-1303(28 Aug 26)

    fix(web): populate the reason for "cannot commit to branch" in web editor commit form (#39155) Co-authored-by: wxiaoguang <[email protected]>

  • Willem Kokke(28 Aug 26)

    refactor(automerge): fix error handling, populate recent automerge tasks on restart (#39001) * Refactor "automerge" related code, clarify many details (including "unique queue item", start check by pull head or commit) * Fix automerge queue handler's error handling, clarify error messages * Populate recent automerge tasks on restart to restore the previous aborted automerge tasks Co-authored-by: wxiaoguang <[email protected]>

  • silverwind(28 Aug 26)

    chore(frontend): avoid loading CSS twice in vite dev mode (#39160)

Gitea Security

7/10

Repo Security Summary

Updated 24 Aug 26 Fuzz tested

  • Security-Policy10/10
  • Code-Review8/10
  • Maintained10/10
  • Dangerous-Workflow0/10
  • CII-Best-Practices5/10
  • Token-Permissions10/10
  • License10/10
  • Binary-Artifacts10/10
  • Fuzzing10/10
  • Packaging10/10
  • Pinned-Dependencies8/10
  • Branch-Protection3/10
  • Signed-Releases8/10
  • SAST0/10

Security Advisories (100)

  • mediumPatchedCVSS 5.9

    CVE-2026-78433Attachments created before the January 2026 cutoff skip the cross repository check entirely, and permission is then evaluated against the repository named in the URL rather than the repository owning the attachment, so a private repository's attachment is served through any public repository's path

  • mediumPatchedCVSS 4.3

    CVE-2026-68964Restricted users can read limited-visibility users’ SSH and GPG keys through the API

  • highPatched

    CVE-2026-68957Restricted users can read limited-visibility users' issue titles and bodies through issue search

  • mediumPatchedCVSS 4.3

    CVE-2026-67577Restricted users can access limited-visibility users' activity feeds and contribution heatmaps through the API

  • highPatchedCVSS 8.7

    CVE-2026-66877RCE on self-hosted runners | fork-PR approval gate (`NeedApproval`) bypass via job-level concurrency cancellation

  • mediumPatchedCVSS 6.5

    CVE-2026-66874A fork pull request author can satisfy a required Actions status check without any workflow running, because a filtered out workflow taken from the pull request HEAD posts a `skipped` commit status that counts as success

  • lowPatched

    CVE-2026-66853Restricted users can enumerate limited-visibility organizations via the user org-list API (authorization bypass)

  • mediumPatched

    CVE-2026-66849Package registry: restricted users can read packages of limited-visibility users (authorization bypass)

  • mediumPatchedCVSS 6.3

    CVE-2026-63792Fork pull requests can read reusable workflow files from another private repository (missed sibling of GHSA-fj8v-hjwv-qm88)

  • mediumPatchedCVSS 6.5

    CVE-2026-63021Swift registry per-file 128KiB manifest guard bypassed by aggregation

  • mediumPatchedCVSS 6.5

    CVE-2026-62925Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memory

  • mediumPatchedCVSS 6.5

    CVE-2026-60021Authenticated DoS in GitLab migration via uncancelable version probe

  • mediumPatchedCVSS 6.5

    CVE-2026-60018Authenticated DoS in OneDev migration via unbounded version response body

  • highPatchedCVSS 8.1

    CVE-2026-60010Repo-side team-link endpoint still bypasses RepoAdminChangeTeamAccess

  • highPatchedCVSS 7.5

    CVE-2026-73539Remote Code Execution via unescaped markup `Context` into external renderer argv

  • mediumPatchedCVSS 6.5

    CVE-2026-73814Admin repository collaborator can self-escalate to Owner and transfer the repository

  • mediumPatched

    CVE-2026-60008Jupyter notebook renderer emits attacker-controlled CSS classes into unsanitized, unsandboxed output

  • mediumPatchedCVSS 4.3

    CVE-2026-73273Package size quota bypass and unbounded memory read in the Maven checksum upload path

  • mediumPatchedCVSS 5.3

    CVE-2026-73135Repository listing exposes repositories owned by hidden users due to inconsistent visibility predicate

  • mediumPatched

    CVE-2026-73130Unbounded gitignores repository-creation field enables linear template-read amplification

  • mediumPatchedCVSS 4.3

    CVE-2026-73126Gitea workflow badge bypasses API token scopes

  • highPatchedCVSS 8.8

    CVE-2026-735352FA bypass and persistent account takeover via OpenID identity linking

  • lowPatched

    CVE-2026-73504Unauthenticated artifact-to-repository oracle in raw Actions downloads

  • lowPatched

    CVE-2026-71301Wiki-only members can read private pull request titles through markup preview

  • highPatchedCVSS 8.8

    CVE-2026-71184Gitea Actions: fork pull request approval bypass via `pull_request_review_comment` (missing `WithPullRequest`)

  • mediumPatched

    CVE-2026-70407Token Scope Bypass on `GET /api/v1/orgs`

  • criticalPatchedCVSS 9.8

    CVE-2026-60004Remote Code Execution via diffpatch Git Hook Installation

  • criticalPatchedCVSS 9.8

    CVE-2026-59774Unauthenticated Arbitrary File Read can lead to RCE

  • highPatchedCVSS 8.8

    CVE-2026-73800Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events

  • highPatchedCVSS 8.1

    CVE-2026-73278WebAuthn second factor is bypassed on OAuth2/OpenID sign-in (WebAuthn-only users)

  • mediumPatchedCVSS 5.8

    CVE-2026-70402Permissive Git hook directory and script modes may allow local code execution as the Gitea service account

  • mediumPatchedCVSS 5.4

    CVE-2026-70400Repository migration skips public-only token guard for private repository creation

  • mediumPatchedCVSS 5.4

    CVE-2026-70396Organization repository creation endpoint skips repository token scope

  • mediumPatched

    CVE-2026-58438Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

  • highPatched

    CVE-2026-58433Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

  • mediumPatchedCVSS 6.8

    CVE-2026-58440Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

  • mediumPatchedCVSS 4.3

    CVE-2026-59766CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

  • mediumPatchedCVSS 6.3

    CVE-2026-58441SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

  • mediumPatchedCVSS 6.5

    CVE-2026-58442Repository migration SSRF via multi-answer DNS allow-list bypass

  • criticalPatchedCVSS 9.6

    CVE-2026-58443Public-only repository tokens can update private PR head branches

  • highPatchedCVSS 8.1

    CVE-2026-73804User-scoped tokens can mint unscoped HTTP signature API credentials

  • criticalPatchedCVSS 9.9

    CVE-2026-73802gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

  • mediumPatchedCVSS 4.3

    CVE-2026-58444Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

  • mediumPatched

    CVE-2026-58427Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

  • lowPatchedCVSS 2.7

    CVE-2026-58445Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

  • mediumPatchedCVSS 6.5

    CVE-2026-42931Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

  • mediumPatchedCVSS 6.3

    CVE-2026-58416Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

  • mediumPatchedCVSS 4.3

    CVE-2026-50105RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

  • lowPatched

    CVE-2026-58417REST API exposes organization membership of private organizations to public

  • highPatchedCVSS 7.5

    CVE-2026-54481Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

  • mediumPatchedCVSS 4.3

    CVE-2026-27761API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

  • mediumPatchedCVSS 6.5

    CVE-2026-58418SSRF via HTTP Redirect in Repository Migration

  • lowPatched

    CVE-2026-58434Private Repository Metadata Remains Accessible After Access Revocation

  • highPatched

    CVE-2026-24451Fork Synchronization Continues After Parent Repository Changes from Public to Private

  • mediumPatched

    CVE-2026-55982OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

  • mediumPatched

    CVE-2026-25038Unauthorized Access to Labels of Private Organizations

  • lowPatched

    CVE-2026-58419Notification API leaks private issue metadata after access revocation

  • highPatchedCVSS 7.1

    CVE-2026-20779TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

  • lowPatchedCVSS 2.7

    CVE-2026-55984Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

  • mediumPatchedCVSS 5.4

    CVE-2026-55986Email Management API Bypasses ManageCredentials Feature Restrictions

  • highPatched

    GHSA-rjvx-x5h2-6px5API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions

  • mediumPatched

    CVE-2026-58420Local File Inclusion via file:// URI in Migration Restore

  • highPatched

    CVE-2026-27775Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

  • highPatched

    CVE-2026-58435Gitea LFS Deploy-Key Privilege Escalation

  • highPatchedCVSS 8.1

    CVE-2026-55987OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

  • mediumPatchedCVSS 4.3

    CVE-2026-56443Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

  • highPatchedCVSS 7.1

    CVE-2026-28740Git LFS object reuse allows non-Code access to authorize private source objects

  • mediumPatched

    CVE-2026-56654Privilege Escalation via Access Token Scope Escalation in API

  • mediumPatchedCVSS 4.3

    CVE-2026-58431Public-only API token restriction is not enforced on team API routes

  • mediumPatched

    CVE-2026-56657Gitea SSH Key Parser Denial of Service

  • mediumPatched

    CVE-2026-58421Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

  • lowPatched

    CVE-2026-56750Gitea Remember-Me Token Theft Not Invalidating Attacker Session

  • mediumPatched

    CVE-2026-56755Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

  • mediumPatchedCVSS 5.9

    CVE-2026-57886Cross-repository issue/comment attachment re-linking can expose private attachment content

  • highPatched

    CVE-2026-58422Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

  • criticalPatchedCVSS 9.8

    CVE-2026-20896Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

  • highPatchedCVSS 8.5

    CVE-2026-57894Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

  • highPatchedCVSS 7.7

    CVE-2026-58423LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

  • highPatched

    CVE-2026-58436ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

  • mediumPatchedCVSS 6.5

    CVE-2026-57897Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

  • highPatched

    CVE-2026-58314Two SSRF findings in Gitea 1.26.2

  • highPatchedCVSS 8.9

    CVE-2026-58424Permanent Fork PR Workflow Approval Gate Bypass

  • mediumPatchedCVSS 4.3

    CVE-2026-58425OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

  • criticalPatchedCVSS 9.6

    CVE-2026-22874Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

  • mediumPatchedCVSS 5.3

    CVE-2026-58507Private Repository Existence Disclosure via go-get Meta Endpoint

  • highPatchedCVSS 7.1

    CVE-2026-58437Repository Visibility Manipulation via Git Push Options

  • mediumPatchedCVSS 4.3

    CVE-2026-27783Missing repository-unit authorization on issue-template API endpoints

  • mediumPatched

    CVE-2026-58508Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

  • mediumPatched

    CVE-2026-20706Token scope bypass on web archive download endpoint (variant of PR #37698)

  • mediumPatched

    CVE-2026-58510GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

  • mediumPatchedCVSS 6.5

    CVE-2026-58428Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

  • highPatchedCVSS 8.1

    CVE-2026-24791Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

  • mediumPatchedCVSS 5.9

    CVE-2026-58432Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

  • criticalPatchedCVSS 9.6

    CVE-2026-58426Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

  • lowPatchedCVSS 2.7

    CVE-2026-58511Webhook Authorization Header Returned in Plaintext via API

  • highPatchedCVSS 8.1

    CVE-2026-28744Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens

  • mediumPatched

    CVE-2026-59763Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

  • highPatchedCVSS 8.2

    CVE-2026-27771Critical Vulnerability - Already emailed

  • lowPatchedCVSS 3.1

    CVE-2026-23603Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

  • highPatchedCVSS 8.1

    CVE-2026-28699OAuth2 access token scope enforcement bypass via HTTP Basic authentication

Gitea Website

Website

301 Moved Permanently

Redirects

Redirects to https://gitea.com/

Security Checks

1 security checks failed (64 passed)

  • External Redirect Detected

Server Details

  • IP Address104.21.17.32
  • LocationSan Francisco,California,United States of America,NA
  • ISPCloudFlare Inc.
  • ASNAS13335

Associated Countries

  • USUS

Safety Score

Website marked as safe

100%

Blacklist Check

gitea.io was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report atweb-check.xyz

Gitea Docker

Container Info

gitea

Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD.

#Web#Tools

View on DockerHub

gitea/gitea:latest

Run Command

docker run -d \
  -p 3000:3000/tcp \
  -p 222:22/tcp \
  -e PUID=${PUID} \
  -e PGID=${PGID} \
  -v /portainer/Files/AppData/Config/Gitea:/data \
  -v  /etc/timezone:/etc/timezone:ro \
  -v /etc/localtime:/etc/localtime:ro \
  --restart=unless-stopped \
  gitea/gitea:latest

Compose File

version: 3.8
services:
  gitea:
    image: "gitea/gitea:latest"
    ports:
      - "3000:3000/tcp"
      - "222:22/tcp"
    environment:
      PUID: 1000
      PGID: 100
    volumes:
      - "/portainer/Files/AppData/Config/Gitea:/data"
      - " /etc/timezone:/etc/timezone:ro"
      - "/etc/localtime:/etc/localtime:ro"
    restart: unless-stopped

Environment Variables

  • Var NameDefault
  • PUID1000
  • PGID100

Port List

  • 3000:3000/tcp
  • 222:22/tcp

Volume Mounting

  • Container PathHost Bind
  • /data/portainer/Files/AppData/Config/Gitea
  • /etc/timezone:ro /etc/timezone
  • /etc/localtime:ro/etc/localtime

Gitea Reviews

More Code Hosting

View More...

About the Data: Gitea

Change History

Edit Gitea Data

You can edit Gitea's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete Gitea Submit Edit to Gitea Add alternative

API

You can access Gitea's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/gitea

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Gitea

Help your friends compare Code Hosting, and pick privacy-respecting software and services.
Share Gitea and Awesome Privacy with your network!

← Previous

GitLab

View Code Hosting (5)
Next →

Gogs