CVE-2021-45326

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.gitea.io/2018/10/gitea-1.5.2-is-released/Release Notes, Vendor Advisory
https://github.com/go-gitea/gitea/issues/4838Issue Tracking, Third Party Advisory
https://github.com/go-gitea/gitea/pull/4840Patch, Third Party Advisory
https://blog.gitea.io/2018/10/gitea-1.5.2-is-released/Release Notes, Vendor Advisory
https://github.com/go-gitea/gitea/issues/4838Issue Tracking, Third Party Advisory
https://github.com/go-gitea/gitea/pull/4840Patch, Third Party Advisory

Timeline

Published: Feb 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-453279.8Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. wh CVE-2021-453286.1Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.CVE-2021-453296.1Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL CVE-2021-453309.8An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and t CVE-2021-453319.8An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP CVE-2021-453349.8Sourcecodester Online Thesis Archiving System 1.0 is vulnerable to SQL Injection. An attacker can bypass admin authentication and gain acces CVE-2021-453358.8Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of CVE-2021-453368.8Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated CVE-2021-453378.8Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to CVE-2021-453387.8Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unn CVE-2021-453397.8Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted p CVE-2021-453406.5In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a