Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Gitea bug bounty programs

gitea.com Updated

Gitea runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
15
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Gitea runs.

  • Gitea

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

15 targets. 6 excluded.

  • https://about.gitea.com

    Web

  • Archive generation, raw file serving, attachments and avatar handling

    Products and areas

  • Authentication in full: local accounts, OAuth2 providers, OpenID Connect, LDAP, SMTP, PAM and SPNEGO, plus two-factor and WebAuthn handling

    Products and areas

  • Every package registry the binary ships, covering Container, npm, Maven, PyPI, Go, Composer, NuGet, Debian, RPM, Alpine and the rest, along with the authentication on each

    Products and areas

  • Git LFS storage and the object access checks in front of it

    Products and areas

  • Gitea Actions end to end: the runner registration and protocol, job dispatch, secret and variable injection, and workflow triggering from forks and pull requests

    Products and areas

  • Personal access tokens and their scopes, OAuth2 application authorization, and the API key paths scripted consumers use

    Products and areas

  • Pull request merging, protected branches and the approval rules meant to gate a merge

    Products and areas

  • Rendering of Markdown, issue and comment content, repository files and the file preview paths

    Products and areas

  • Repository access control across public, private, limited and internal visibility, and the organisation, team and collaborator model on top of it

    Products and areas

  • SECURITY.md asks reporters not to file a public issue and to send the report privately to [email protected], offering public thanks in return. It declares no boundary narrower than Gitea itself

    Products and areas

  • The built-in web editor, file upload, and the notification and mail paths

    Products and areas

  • The full HTTP API, the admin panel and every setting an administrator can change on a running instance

    Products and areas

  • The Git transport layer over HTTP and SSH, including the built-in SSH server, authorized keys handling and the internal protocol between components

    Products and areas

  • Webhooks, repository migration and mirroring, and every other path where Gitea fetches a URL a user supplied

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A repository, organisation or package an administrator deliberately made public

  • Forgejo, a separate fork with its own security process, even where the code is shared

  • The git binary and any external tool Gitea shells out to

  • The reverse proxy and TLS termination in front of Gitea

  • Third-party themes, templates and custom assets an operator installed

  • Workloads a user's own Actions workflow chose to run, which execute what the workflow author wrote

Recent changes

Reward and scope changes across every Gitea program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Gitea products, from the NVD.

Search NVD
  • CVE-2026-86684 High

    The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into

  • CVE-2026-89182 Medium

    With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.

  • CVE-2026-96594 Medium

    The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in t

  • CVE-2026-97208 Medium

    The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository

  • CVE-2026-105267 High

    The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules

  • CVE-2026-105268 Medium

    The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachmen

  • CVE-2026-104633 Medium

    When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of

  • CVE-2026-101023 Critical

    Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime.

About this page

This page gathers every public program listed under gitea.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.