Techknowlogick

The issue is related to a Cross Site Request Forgery (CSRF) vulnerability in the Gitea Git repository management system interface. This vulnerability can be exploited by a remote attacker to perform a CSRF attack by sending specially crafted POST requests, potentially altering the state of the system. The vulnerability is particularly dangerous with state-altering POST requests.

The issue allows for 1-factor authentication (1FA) for user accounts that have completed 2-factor authentication (2FA) enrollment. If a user's credentials are known, an attacker could send them to the API without requiring the 2FA one-time password. This could potentially lead to unauthorized access.

The issue results in the exposure of users' private email addresses. This can be exploited by watching a repository to receive email notifications, which contain the other recipients even if they have their email set as private.