De3Erve

**Name of the Vulnerable Software and Affected Versions** Hi.Events versions prior to 1.11.1-beta **Description** An issue exists where webhook destinations are validated only during registration and not during use. The `NoInternalUrlRule` function in `backend/app/Validators/Rules/NoInternalUrlRule.php` uses `gethostbyname()` to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the `WebhookDispatchService` utilizes the stored URL via `spatie/laravel-webhook-server` without re-validating the destination. Because `backend/config/webhook-server.php` does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The `WebhookResponseHandlerService` stores the response body in the webhook log, which is then exposed via the `WebhookLogResource` endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks. **Recommendations** Update Hi.Events to version 1.11.1-beta.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** The team-repository linking endpoint bypasses the `RepoAdminChangeTeamAccess` organization setting, which is intended to control whether repository administrators can change team access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.26.5 **Description** A broken access control issue exists in the `RemoveDependency` function within `routers/web/repo/issue dependency.go`. The function processes the `removeDependencyID` form parameter to identify and remove an issue dependency using `issues model.GetIssueByID(ctx, depID)` without performing necessary repository or permission checks. This allows an attacker with write access to issues in one repository to remove a dependency link to an issue in a different private repository and inject a comment into that private repository, even if they lack read access to it. This is an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization. **Recommendations** Update Gitea to version 1.26.5 or later. As a temporary mitigation, restrict the use of the `removeDependencyID` parameter in the `/owner/repo/issues/N/dependency/delete` endpoint to authorized users only.