Description (CNA)
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Gitea / Gitea Open Source Git Server | affected 0 through 1.25.3 |
CWE
CWE-284, CWE-639
References
- https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw
- https://github.com/go-gitea/gitea/pull/36320
- https://github.com/go-gitea/gitea/pull/36355
- https://github.com/go-gitea/gitea/releases/tag/v1.25.4
- https://blog.gitea.com/release-of-1.25.4/
ADP enrichment
No English description supplied.
No references supplied.
An access control flaw has been discovered in Gitea. Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.