Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
The vulnerability consists of lack of proper validation of attachment ownership to a repository during the operation of linking it to a release. An attacker can upload an attachment to a private repository and then link it to a release in another public repository. As a result, a file originally restricted to a private repository becomes accessible to all users with access to the public repository.
An attacker can gain unauthorized access to confidential files stored in private repositories and manipulate their associations with releases in other repositories, leading to violations of data confidentiality and integrity.
Gitea should be updated to version v1.25.4 or newer, which contains fixes described in pull requests #36320 and #36355. Details available at: https://blog.gitea.com/release-of-1.25.4/
Gitea — versions indicated in producer references (patches available in version v1.25.4)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NGitea
APPGitea< 1.25.4
Related vulnerabilities
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Gitea: nieprawidłowa walidacja własności projektów organizacji
Gitea: nieautoryzowane usuwanie blokad Git LFS między repozytoriami
Gitea: brak sanityzacji refs prowadzący do wstrzyknięcia argumentów git
Gitea: nieprawidłowe unieważnianie sesji umożliwia przejęcie uprawnień