Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/v1/user/starred and GET /api/v1/user/subscriptions endpoints. An attacker can access repository metadata, such as repository name, description, and visibility status, by querying these endpoints...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the internal API HTTP client hardcoding InsecureSkipVerify to true in the TLS configuration, which disables certificate validation for outbound HTTPS connections. An attacker can intercept internal...

GHSA-94V3-77J7-VM48 Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Summary Gitea's internal API HTTP client modules/private/internal.go hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration override. It is the only outbound TLS client in the codebase that cannot be made to verify its peer's certificate — webhook, migrations, MinIO, LDAP, SMTP...

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Summary Gitea's internal API HTTP client modules/private/internal.go hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration override. It is the only outbound TLS client in the codebase that cannot be made to verify its peer's certificate — webhook, migrations, MinIO, LDAP, SMTP...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the internal API HTTP client hardcoding InsecureSkipVerify to true in the TLS configuration, which disables certificate validation for outbound HTTPS connections. An attacker can intercept internal...

GHSA-JR5X-6H83-WRXF Gitea: REST API exposes organization membership of private organizations to public

Summary The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization. PoC 1. Spin up the nightly container of Gitea. 2. Perform the default installation. 3. Register a new user let's call this user "user1". 4. Create a new...

Gitea: REST API exposes organization membership of private organizations to public

Summary The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization. PoC 1. Spin up the nightly container of Gitea. 2. Perform the default installation. 3. Register a new user let's call this user "user1". 4. Create a new...

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform no token-scope or public-only enforcement. A personal access token that is correctly blocked HTTP 403 from a private repository on /raw, /media, /archive, and /releases/download/... — because it is marked public-only o...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the RSS/Atom feed handlers, which accept API-token Basic authentication but do not enforce token scope or public-only restrictions. An attacker can access private repository metadata, such as commit information,...

GHSA-6CQF-375W-639G Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform no token-scope or public-only enforcement. A personal access token that is correctly blocked HTTP 403 from a private repository on /raw, /media, /archive, and /releases/download/... — because it is marked public-only o...

GHSA-FJ8V-HJWV-QM88 Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Summary GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that i...

GHSA-WWQQ-X6W4-FRM2 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the DeleteIssueLabel function. An attacker can determine the existence of label IDs across repositories, including those they do not have access to, by observing differing HTTP respon...

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Summary The API endpoint DELETE /repos/owner/repo/issues/index/labels/id loads the label by ID with a global, unscoped lookup and never verifies the label belongs to the URL's repository or its owning organization. Because the response status differs by whether the label ID exists anywhere on the...

GHSA-PGQF-926R-548M Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Summary The API endpoint DELETE /repos/owner/repo/issues/index/labels/id loads the label by ID with a global, unscoped lookup and never verifies the label belongs to the URL's repository or its owning organization. Because the response status differs by whether the label ID exists anywhere on the...

Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Summary A personal access token PAT or OAuth2 token that does not carry the repository scope or that is public-only is correctly rejected HTTP 403 by the recently hardened web content routes archive download, raw/media file download, and repository RSS/Atom feeds. However, the repository home pag...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the repo.Home handler when a personal access token or OAuth2 token lacking the required scope is used. An attacker can access private repository content, including the README, root file and directory...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the repo.Home handler when a personal access token or OAuth2 token lacking the required scope is used. An attacker can access private repository content, including the README, root file and directory...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the repo.Home handler when a personal access token or OAuth2 token lacking the required scope is used. An attacker can access private repository content, including the README, root file and directory...

GHSA-CP3Q-VRJ2-GHHH Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Summary A personal access token PAT or OAuth2 token that does not carry the repository scope or that is public-only is correctly rejected HTTP 403 by the recently hardened web content routes archive download, raw/media file download, and repository RSS/Atom feeds. However, the repository home pag...