Jebeenlee

In organizations where the setting for who can view all other users restricts guests from viewing other users, saving or editing a direct message draft fails to verify if the sender has permission to access the draft recipients. This allows a guest to obtain profile information of restricted users without sending a message.

A bypass exists for the `public-only` Personal Access Token (PAT) scope when the owner's visibility is set to Limited (instance-internal). While other scope categories correctly reject Limited owners, the Repository and Package categories only check if the resource is private, failing to account for Limited visibility. This allows a token with `public-only` scope to access content that should be restricted to internal users, exceeding the reach of an anonymous user. Technical details include the following affected areas: - **API Endpoints:** API v1 packages, all 24 native package registries via `/api/packages/<type>/...`, all API v1 Repository-category endpoints (including content, issues, PRs, releases, labels, and milestones), and web download endpoints such as `/raw`, `/media`, and `/attachments`, as well as LFS routes. - **Vulnerable Parameters or Variables:** `public-only` PAT scope. - **Function Names:** `checkTokenPublicOnly()`, `reqPackageAccess()`, `TokenCanAccessRepo()`, and `CheckTokenScopes()`.

Three code paths bypass the existing Server-Side Request Forgery (SSRF) protections by using raw `http.Get()` instead of the validated `hostmatcher.NewDialContext()` dialer. This allows an attacker to make requests to internal services, scan internal networks (such as `127.0.0.1`, `10.x`, `172.16-31.x`, and `192.168.x`), and steal cloud metadata from endpoints like `169.254.169.254` (e.g., AWS IMDSv1 credentials or GCP tokens). Additionally, the use of the `file://` scheme in the `Open()` function enables local file read, potentially exposing sensitive files such as `/etc/gitea/app.ini` which may contain database credentials and JWT signing secrets. The issue affects the following components: - The `Open()` function in `modules/uri/uri.go`. - Release asset and PR patch downloads in `services/migrations/gitea uploader.go` and `services/migrations/dump.go`. - The `oauth2UpdateAvatarIfNeed()` function in `routers/web/auth/oauth.go`.

A Denial of Service issue exists when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the `Readable.pipe()` call does not propagate the stream destroy signal to the underlying `fs.WriteStream`. This allows an attacker to exhaust disk space by triggering numerous aborted uploads.