Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
The bug results from improper access control (CWE-284) and insufficient validation of object identifiers (CWE-639). During Git LFS lock deletion operations, the application does not properly verify whether a given lock actually belongs to the repository in the context of which the requesting user is operating. As a result, an authenticated user with write permissions to any repository can construct an appropriate request and delete an LFS lock from another, unrelated repository.
An attacker can delete Git LFS locks in repositories to which they should not have access, leading to a breach of the integrity of the LFS file management process and potential disruption of work for other users and teams using the affected repositories.
Gitea should be updated to version 1.25.4 or newer, which contains fixes described in pull requests #36344 and #36349. Details available in the official vendor announcement at https://blog.gitea.com/release-of-1.25.4/
Gitea in versions preceding 1.25.4 (based on vendor reference)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NGitea
APPGitea< 1.25.4
Related vulnerabilities
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Gitea: nieprawidłowa walidacja własności projektów organizacji
Gitea: nieautoryzowany dostęp do załączników z prywatnych repozytoriów
Gitea: brak sanityzacji refs prowadzący do wstrzyknięcia argumentów git
Gitea: nieprawidłowe unieważnianie sesji umożliwia przejęcie uprawnień