Pick

An authorization and authentication bypass exists in the 'PUT /api/global/users/tenant/owner' (changeTenantOwnerEmail) endpoint. On self-hosted instances where `SELF HOSTED` or `DISABLE ACCOUNT PORTAL` are set, the `cloudRestricted` middleware is inactive. Consequently, the route is only protected by a general authentication check, allowing any authenticated user, including those with basic privileges, to reassign the tenant account-holder email to an address controlled by an attacker. This allows the attacker to utilize the public password-reset process to seize control of the administrative account and gain full administrative access.

Three code paths bypass the existing Server-Side Request Forgery (SSRF) protections by using raw `http.Get()` instead of the validated `hostmatcher.NewDialContext()` dialer. This allows an attacker to make requests to internal services, scan internal networks (such as `127.0.0.1`, `10.x`, `172.16-31.x`, and `192.168.x`), and steal cloud metadata from endpoints like `169.254.169.254` (e.g., AWS IMDSv1 credentials or GCP tokens). Additionally, the use of the `file://` scheme in the `Open()` function enables local file read, potentially exposing sensitive files such as `/etc/gitea/app.ini` which may contain database credentials and JWT signing secrets. The issue affects the following components: - The `Open()` function in `modules/uri/uri.go`. - Release asset and PR patch downloads in `services/migrations/gitea uploader.go` and `services/migrations/dump.go`. - The `oauth2UpdateAvatarIfNeed()` function in `routers/web/auth/oauth.go`.