Gitea Multiple API Authorization Bypass and Validation Flaws

Vulnerability Overview This vulnerability involves missing necessary checks in multiple APIs and web handlers, leading to potential security issues. Specifically: The push mirror API does not verify or the caller's permissions. The media API service does not use standard content headers for small files. The issue attachment API ignores comment attachments. The push creation operation does not enforce . Profile and follow operations do not respect and owner visibility settings. The tag deletion route does not reject tag deletion requests. The refresh token grant only accepts refresh tokens. The Gitea migration binds to the source's page size. Impact Scope Push Mirror API: Failure to verify and caller permissions may lead to unauthorized push operations. Media API: Not using standard content headers may impact the security and integrity of files. Issue Attachment API: Ignoring comment attachments may result in the loss or inconsistency of attachment information. Push Creation Operation: Failure to enforce may lead to unintended public pushes. Profile and Follow Operations: Failure to respect and owner visibility may result in information disclosure. Tag Deletion Route: Failure to reject tag deletion requests may lead to accidental tag deletion. Refresh Token Grant: Accepting only refresh tokens may lead to improper token management. Gitea Migration: Binding to the source's page size may affect the stability of the migration process. Remediation Push Mirror API: Add checks for and caller permissions. Media API: Ensure standard content headers are used when serving small files. Issue Attachment API: Properly handle comment attachments. Push Creation Operation: Enforce . Profile and Follow Operations: Respect and owner visibility settings. Tag Deletion Route: Reject tag deletion requests. Refresh Token Grant: Ensure only valid refresh tokens are accepted. Gitea Migration: Optimize the binding to the source's page size to improve migration stability. POC Code No specific POC code or exploitation code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Gitea Multiple API Authorization Bypass and Validation Flaws

More from this source