Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.
The vulnerability stems from improper access control (CWE-284) during operations on organizational projects. A user with write permissions in a project of one organization can send requests concerning projects belonging to another organization, as Gitea does not properly verify whether the given project actually belongs to the organization specified in the request. This allows bypassing isolation boundaries between organizations.
An attacker can unauthorized modify projects belonging to organizations for which they do not have permissions, violating data integrity and compromising the confidentiality of project configurations of other organizations.
Update Gitea to version 1.25.4 or later. Patch available in vendor references: https://github.com/go-gitea/gitea/releases/tag/v1.25.4
Gitea — versions indicated in vendor references (vulnerability fixed in version 1.25.4)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NGitea
APPGitea< 1.25.4
Related vulnerabilities
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Gitea: nieautoryzowane usuwanie blokad Git LFS między repozytoriami
Gitea: nieautoryzowany dostęp do załączników z prywatnych repozytoriów
Gitea: brak sanityzacji refs prowadzący do wstrzyknięcia argumentów git
Gitea: nieprawidłowe unieważnianie sesji umożliwia przejęcie uprawnień