Gitea API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration

Vulnerability Overview Title: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration Description: This vulnerability affects the Gitea API endpoint , which checks only but fails to verify . This allows a read-only organization member (in a team with permissions) to fork a repository into the organization namespace via the API, thereby leveraging runner infrastructure to exfiltrate organization-level global CI/CD secrets (such as deployment keys, cloud credentials, and API keys). Scope of Impact Affected Versions: < 1.26.0 Fixed Version: 1.26.0 Severity: 8.1 / 10 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None Remediation Fixed Version: 1.26.0 POC Code 1. Environment Setup 2. Create Target Environment (as admin) 3. Register Actions Runner 4. Verify Attacker Cannot Create Repositories in the Organization (Expected: 403) 5. Exploit: Fork Repository into the Organization via API (Bypass) 6. Enable Actions and Exfiltrate Workflow 7. Verify Secret Exfiltration Impact Impact Description: Read-only organization members (without repository creation permissions, ) can exfiltrate all organization-level CI/CD secrets by exploiting the missing authorization check in the API. The Web UI correctly enforces the permission, but the API does not, creating a classic authorization inconsistency between API and Web. Attack Chain: (1) The attacker forks an existing organization repository into the same organization, bypassing the check; (2) Gains admin privileges on the resulting forked repository; (3) Enables Actions and pushes a workflow referencing organization secrets; (4) Organization runner picks up the job (runner matches ), and organization secrets are injected into the workflow environment (triggered by ); (5) Workflow exfiltrates all organization secrets. Potential Risks: Organization secrets typically include deployment keys, cloud credentials (AWS IAM keys, GCP service accounts), container registry tokens, and personal access tokens, often with broad scopes. Credential leakage can lead to lateral movement against cloud infrastructure, private repositories, and external services, extending beyond the Gitea instance itself. Attackers can also push arbitrary code to trusted namespaces within the organization, creating supply chain risks for downstream consumers. Particularly Dangerous: Organizations often use read-only teams for auditors, reviewers, contractors, or new employees—users who should not have access to production keys. Supporting Materials / References poc-fork-authz-bypass.zip: ZIP archive containing the complete exploitation script and README Vulnerable Code: API fork handler (missing check) - https://github.com/go-gitea/gitea/blob/799563e3e24/services/repository/fork.go#L135-L144 Fixed Code: Web fork handler (with check) - https://github.com/go-gitea/gitea/blob/799563e3e24/models/webhooks/webhook.go#L181-L189 Runner Task Assignment (matching ): - https://github.com/go-gitea/gitea/blob/799563e3e24/models/actions/task.go#L245-L248 Secret Injection (triggered by ): - https://github.com/go-gitea/gitea/blob/799563e3e24/models/secret/secret.go#L167 Fork Creator Gets Admin Permissions: - https://github.com/go-gitea/gitea/blob/799563e3e24/services/repository/create.go#L433-L440 Related PR #24011: Fixed a similar bypass via repository forking, confirming that such authorization inconsistencies are treated as vulnerabilities OWASP API Security Top 10 2023: API5 — Broken Function Level Authorization OWASP Top 10 2021: A01 — Broken Access Control

Goal Reached Thanks to every supporter — we hit 100%!

Gitea API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration

More from this source