Rz1027

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

An argument injection flaw allows local users to execute arbitrary code with the privileges of other accounts hosted on the same server.

An improper authorization flaw exists during the issuance of passkey or passwordless enrollment codes. The system validates the organization specified in the `x-zitadel-orgid` header but fails to verify the organization of the target user. This allows an attacker with user-write permissions in one organization to obtain an enrollment code for a user belonging to a different organization on the same instance, enabling the attacker to register their own authenticator and take over the account.

A stored Cross-Site Scripting (XSS) issue exists in the Manage SSL Hosts interface. This flaw allows an attacker with low privileges to execute arbitrary code, potentially impacting confidentiality, integrity, and availability.

A stored Cross-Site Scripting (XSS) issue exists in the Mass Modify Accounts interface. This flaw allows an attacker with low privileges to execute arbitrary code, impacting confidentiality, integrity, and availability.

Insufficient validation in the Multilang adminbin allows for the execution of arbitrary commands, which can grant root-level access to the server. Additionally, stored Cross-Site Scripting (XSS)—a technique where malicious scripts are permanently stored on a target server—exists within the SSL and account modification interfaces, enabling attackers to perform actions via an administrator's browser session.

File owners are unable to unlock TYPE TOKEN locks that were placed by other users. This results in files remaining permanently locked, with no available recovery method outside of direct database intervention.

Authenticated users with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys. The system fails to redact credentials stored in STRING typed fields, which allows the exposure of MongoDB connection strings and Firebase private keys in plaintext.

A configuration flaw in the official Docker images allows an unauthenticated remote attacker to impersonate any user, including administrators, by spoofing the `X-WEBAUTH-USER` header. This occurs because the `app.ini` template hard-codes the `REVERSE PROXY TRUSTED PROXIES` variable to a wildcard (`*`), causing the application to trust identity headers from any source IP address instead of only trusted loopback addresses. This issue is exploitable when reverse-proxy authentication is enabled. It is estimated that approximately 22,900 unique Gitea hosts are accessible from the internet, with 83% potentially affected. Real-world reconnaissance and exploitation attempts were detected within 13 days of public disclosure. The flaw allows access to repositories, CI/CD secrets, SSH keys, and administrative functions via the web interface, although the token-based API endpoints (e.g., `/api/v1/...`) are not affected.