Prakhar0X01

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** A blind Server-Side Request Forgery (SSRF) exists when the `[oauth2 client] UPDATE AVATAR = true` setting is enabled. The issue occurs because the server fetches the avatar URL provided by an OAuth2/OIDC provider—typically the `picture` claim—using the default Go HTTP client without applying outbound host or IP restrictions. A low-privileged user who can influence their own `picture` claim can force the Gitea server to make arbitrary outbound HTTP GET requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as `169.254.169.254`. Technical details include: - **Vulnerable Function**: `oauth2UpdateAvatarIfNeed()` in `routers/web/auth/oauth.go` and `oauth2SignInSync()` in `routers/web/auth/oauth signin sync.go`. - **Vulnerable Variable**: `gothUser.AvatarURL`. While the issue is primarily blind because non-image responses are rejected, the impact increases if the server can reach cloud metadata services or internal services that return valid image data, which could then be stored as the user's avatar. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, disable the avatar synchronization feature by setting `UPDATE AVATAR = false` in the `[oauth2 client]` section of the configuration.

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** An authorization issue exists in the organization-level Actions REST endpoints. The endpoints `/api/v1/orgs/{org}/actions/runs` and `/api/v1/orgs/{org}/actions/jobs` only verify organization membership and token validity, failing to perform per-repository Access Control List (ACL) checks. Consequently, any authenticated organization member can enumerate workflow runs and jobs from every repository within that organization, including private repositories for which the user has no explicit access or has been denied permissions. This flaw allows an attacker to use the endpoints as a search oracle to gather sensitive metadata from private repositories, such as repository names, descriptions, clone URLs, commit SHAs, branch names, workflow filenames, commit messages, and contributor identities. This can lead to organization reconnaissance, revealing product plans, security fix windows, or internal project topologies. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the undocumented push options `repo.private` and `repo.template` during a `git push` to toggle a repository's visibility between private and public or change its template status. This process occurs within the `HookPostReceive()` function in the `routers/private/hook post receive.go` file. This action bypasses standard security controls and administrative tracking, resulting in no entries in the repository audit or activity logs, no webhook events, no organization-level notifications, and no email alerts to watchers. Additionally, the use of the `UpdateRepositoryColsNoAutoTime` function suppresses the `updated at` timestamp, making the change difficult to detect. This could allow an insider threat to temporarily make a private repository public for data exfiltration or silently manipulate repository templates to affect downstream CI/CD pipelines. **Recommendations** As a temporary mitigation, restrict admin-collaborator access to only trusted users to prevent unauthorized visibility changes. Remove the `repo.private` and `repo.template` options from the post-receive hook for existing repositories, ensuring they are only processed during the push-to-create flow. Alternatively, modify the code to route visibility changes through the full visibility-change service to ensure audit events, webhooks, and team re-syncs are properly triggered.

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** Gitea contains an information disclosure issue where requests containing the `go-get` query parameter with a value of `1` bypass authentication and authorization checks. This behavior is triggered in the `httpBase()` and `EarlyResponseForGoGetMeta()` functions. When this parameter is detected in a repository path, the system returns an HTTP 200 response containing metadata tags, regardless of whether the repository is private or the user is authenticated. This allows unauthenticated attackers to confirm the existence of private repositories, enumerate private repository names through brute-force, and harvest sensitive information such as full clone URLs, owner usernames, and default branch names. This occurs because the system was designed to provide a workaround for the Go toolchain's handling of credentials, resulting in an unauthenticated endpoint for every repository. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `go-get` query parameter for private repositories or implement a check to ensure that `EarlyResponseForGoGetMeta()` is only called for public repositories or authenticated users with read permissions.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw exists that allows for a permanent fork pull request workflow approval gate bypass. This issue enables an attacker to circumvent the required approval process when submitting changes from a forked repository. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.