CVE-2018-18926: Gitea

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

Affected products

• Gitea Gitea: before 1.5.4 (fixed in 1.5.4)

Published 2018-11-04. Last modified 2026-06-17.