Yonatan-Pl

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.27.0 **Description** Gitea fails to re-evaluate the `official` flag on existing pull request reviews when the target branch of a pull request is changed. An attacker with write access to a repository can obtain an `official: true` approval on a pull request targeting an unprotected branch and then retarget that pull request to a protected branch. Because the system does not re-verify if the reviewer is in the new target branch's approval whitelist, the stale approval is preserved. This allows the attacker to satisfy protected branch requirements and merge changes without legitimate maintainer approval, effectively bypassing branch protection and escalating privileges. Technical details include the following: - **API Endpoints:** `/api/v1/repos/{owner}/{repo}/pulls` and `/api/v1/repos/{owner}/{repo}/pulls/{index}/reviews` are used during the exploitation process. - **Vulnerable Parameters or Variables:** The `official` flag is stored as a boolean on the review record and is not updated during the `ChangeTargetBranch` process. - **Function Names:** The issue involves `IsUserOfficialReviewer()`, `ChangeTargetBranch()`, and `GetGrantedApprovalsCount()`, which fails to re-check the whitelist against the new branch. **Recommendations** Update Gitea to version 1.27.0 or later. As a temporary mitigation, restrict write access to repositories to only trusted users to prevent unauthorized retargeting of pull requests.

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.25.5 **Description** Improper path resolution occurs during the generation of template repositories. This allows template processing to read or write data through symlinks or other non-regular paths, potentially leading to unauthorized file access or modification. **Recommendations** Update Gitea to version 1.25.5 or later.

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.26.0 **Description** The software does not fail closed when encountering `bufio.Scanner` errors during the processing of pre-receive hook input. This behavior allows oversized input to bypass branch-protection checks. **Recommendations** Update Gitea to version 1.26.0 or later.

**Name of the Vulnerable Software and Affected Versions** Gitea versions 1.25.0 and later **Description** Gitea is subject to stored cross-site scripting (XSS) through the built-in 3D file viewer, which utilizes the Online3DViewer library. The issue occurs when a `.gltf` file contains an unsupported extension within the `extensionsRequired` variable. The viewer generates an error message containing the name of the unsupported extension, which Gitea then inserts into the Document Object Model (DOM) using `innerHTML` without proper sanitization. An attacker can push a specially crafted `.gltf` file to a repository to execute arbitrary JavaScript in the context of any user who views the file. This can lead to full account takeover, including the creation of API access tokens via the `/user/settings/applications` endpoint, reading private repositories, and modifying repository contents. **Recommendations** For Gitea versions 1.25.0 and later, replace the use of `innerHTML` with `textContent` when displaying error messages to ensure the content is treated as text rather than HTML. As a mitigation measure, render 3D file previews inside a sandboxed `<iframe>` with a restrictive Content-Security-Policy (CSP) to limit inline script execution.