Bl4Cksku11

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.26.2 **Description** An issue exists where the OAuth token introspection endpoint allows any authenticated OAuth client to retrieve metadata for tokens issued to other clients, violating RFC 7662 section 4. The server fails to verify if the requesting client is the intended audience of the token, returning sensitive information regardless of ownership. **API Endpoints:** '/login/oauth/introspect' **Vulnerable Parameters or Variables:** `token` **Function Names:** `IntrospectOAuth()` An attacker with a valid OAuth client can use this endpoint as a token-validity oracle to verify if stolen tokens are active without triggering audit trails of actual token use. Additionally, it allows for cross-tenant metadata enumeration, enabling an attacker to identify the `username` and `scope` associated with tokens belonging to other clients. **Recommendations** Update Gitea to a version where the `IntrospectOAuth()` function is patched to verify that the `grant.ApplicationID` matches the requesting client's `app.ID` before returning token metadata. As a temporary workaround, restrict access to the '/login/oauth/introspect' endpoint to trusted clients only.

**Name of the Vulnerable Software and Affected Versions** Gitea version 1.26.1 **Description** A user with repository write permissions can bypass the configured file extension allowlist when renaming release attachments via the web interface. While the API endpoints enforce the `Repository.Release.AllowedTypes` restriction, the web handler `EditReleasePost` in `routers/web/repo/release.go` fails to call the `upload.Verify()` function before updating the attachment name in the database via `repo model.UpdateAttachmentByUUID()`. This allows an attacker to rename a previously uploaded compliant file to a forbidden extension, such as `.exe`, `.html`, or `.svg`. This could be used to distribute malware or host stored Cross-Site Scripting (XSS) attacks if the server renders certain file types inline. **Recommendations** Update Gitea to a version where the `UpdateRelease` function in `services/release/release.go` is updated to verify new attachment names against the `Repository.Release.AllowedTypes` allowlist using `upload.Verify()` before persisting changes. As a temporary mitigation, restrict write permissions on repositories that utilize a release allowlist. As a temporary mitigation, remove the `Repository.Release.AllowedTypes` allowlist to eliminate the bypass, although this removes the intended security restriction.

**Name of the Vulnerable Software and Affected Versions** Daytona versions prior to 0.184.0 **Description** Organization invitations could be accepted or declined by users with an email address matching the invitation that had not been verified. While the system uses OIDC (OpenID Connect, an identity layer on top of the OAuth 2.0 protocol) to match the invitation target email against the caller's token, the paths for accepting and declining invitations did not enforce email verification. This allows an actor using an identity provider that permits self-service signup and issues sessions before verification to register an email matching a pending invitation and join the target organization with the assigned role, which could be as high as Owner. **Recommendations** Update to version 0.184.0.