Published Gitea repository security advisories missing from the global Advisory Database

[0xMax42]

Summary

Two published repository security advisories for Gitea are currently missing from the global GitHub Advisory Database:

GHSA	CVE	Package	Fixed in
GHSA-rcr6-4jqh-j84m	CVE-2026-60004	gitea.dev (Go)	1.27.1
GHSA-6v53-hr58-556r	CVE-2026-59774	gitea.dev (Go)	1.27.1

Both repository advisories are published and contain affected Go package/version information, but neither advisory appears to have been promoted to the global Advisory Database.

CVE-2026-60004 is particularly relevant because it has since been added to CISA's Known Exploited Vulnerabilities catalog.

Evidence

Searching github/advisory-database for either GHSA currently returns no matching advisory record:

GHSA-rcr6-4jqh-j84m -> no result
GHSA-6v53-hr58-556r -> no result

Neither CVE is currently present in golang/vulndb either:

CVE-2026-60004 -> no Go vulnerability record
CVE-2026-59774 -> no Go vulnerability record

This appears to have downstream consequences for vulnerability scanners.

For example, Syft/Grype correctly identifies an affected upstream Gitea binary as:

gitea.dev
v1.27.0-dev.0.20260629012003-8343c47bd112+dirty
go-module

This build predates both fixes and is in the affected version range.

However, Grype does not report either vulnerability for this Go module.

Inspecting the current Grype vulnerability database (v6.1.9, built 2026-08-27) shows why: the CVEs are present only through Alpine package metadata.

For CVE-2026-60004:

apk:forgejo < 15.0.6-r0
apk:gitea   < 1.27.1-r0

For CVE-2026-59774:

apk:gitea < 1.27.1-r0

There is no corresponding vulnerability record for:

Go / gitea.dev < 1.27.1

and searches for the two GHSA identifiers in the Grype database return no results.

As a result, upstream/self-built Gitea binaries can produce a false negative while distro-packaged Gitea installations are detected.

Expected result

Since the published repository advisories already identify the affected ecosystem as Go, package as gitea.dev, and patched version as 1.27.1, I would expect corresponding records to exist in the global GitHub Advisory Database.

This should subsequently allow consumers such as the Go Vulnerability Database and vulnerability scanners to associate the advisories with the gitea.dev Go module.

Related advisories

• GHSA-rcr6-4jqh-j84m / CVE-2026-60004
• GHSA-6v53-hr58-556r / CVE-2026-59774

This is not a new vulnerability disclosure; both vulnerabilities and all information above are already public.