CVE-2021-45327

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-08 · updated 2026-06-17
Weakness: CWE-436

Description

Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code.

Affected products

Gitea Open Source Git Server: before 1.11.2 — fixed in 1.11.2

How to fix

Upgrade to a fixed version: Gitea Open Source Git Server 1.11.2. Check the vendor advisory for mitigations.

References

https://blog.gitea.io/2020/03/gitea-1.11.2-is-released/
https://github.com/go-gitea/gitea/pull/10462
https://github.com/go-gitea/gitea/pull/10465
https://github.com/go-gitea/gitea/pull/10582
https://blog.gitea.io/2020/03/gitea-1.11.2-is-released/
https://github.com/go-gitea/gitea/pull/10462
https://github.com/go-gitea/gitea/pull/10465
https://github.com/go-gitea/gitea/pull/10582

Get alerted when CVE-2021-45327 or the next vulnerability affects your stack