https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:42:46 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10563 bdu:2026-10563 https://cve.radiocsirt.org/vuln/bdu:2026-10563 https://cve.radiocsirt.org/vuln/euvd-2026-333353 EUVD-2026-333353 https://cve.radiocsirt.org/vuln/euvd-2026-333353 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27783 <p>Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.</p> <p>Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27783 https://cve.radiocsirt.org/vuln/ghsa-3fwp-p5rj-2pxf <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Three Gitea API endpoints — `GET /repos/{owner}/{repo}/issue_templates`, `GET /repos/{owner}/{repo}/issue_config` and `GET /repos/{owner}/{repo}/issue_config/validate` — read files from the repository&#39;s **Code** default branch (`.gitea/ISSUE_TEMPLATE/*` and `issue_config.yaml`) and return their contents, but are registered **without** the `reqRepoReader(unit.TypeCode)` authorization middleware that every sibling Code-tree endpoint in the same route group carries.</p> <p>A user who has access to a private repository through *any single repository unit* (for example an organization team granted only the **Issues** unit, with no Code access) can therefore read the issue-template and issue-config files of that repository&#39;s Code tree, which their permission set should not expose.</p> <p>---</p> <p>## Root cause</p> <p>### The three endpoints lack the unit guard</p> <p>`routers/api/v1/api.go:1433-1437`:</p> <p>m.Get(&#34;/issue_templates&#34;, context.ReferencesGitRepo(), repo.GetIssueTemplates) m.Get(&#34;/issue_config&#34;, context.ReferencesGitRepo(), repo.GetIssueConfig) m.Get(&#34;/issue_config/validate&#34;, context.ReferencesGitRepo(), repo.ValidateIssueConfig) m.Get(&#34;/languages&#34;, reqRepoReader(unit.TypeCode), repo.GetLanguages) m.Get(&#34;/licenses&#34;, reqRepoReader(unit.TypeCode), repo.GetLicenses)</p> <p>`context.ReferencesGitRepo()` only opens the git repository — it performs no permission check. Every other endpoint in this group that reads Code-tree content is guarded with `reqRepoReader(unit.TypeCode)`: `/…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Three Gitea API endpoints — `GET /repos/{owner}/{repo}/issue_templates`, `GET /repos/{owner}/{repo}/issue_config` and `GET /repos/{owner}/{repo}/issue_config/validate` — read files from the repository&#39;s **Code** default branch (`.gitea/ISSUE_TEMPLATE/*` and `issue_config.yaml`) and return their contents, but are registered **without** the `reqRepoReader(unit.TypeCode)` authorization middleware that every sibling Code-tree endpoint in the same route group carries.</p> <p>A user who has access to a private repository through *any single repository unit* (for example an organization team granted only the **Issues** unit, with no Code access) can therefore read the issue-template and issue-config files of that repository&#39;s Code tree, which their permission set should not expose.</p> <p>---</p> <p>## Root cause</p> <p>### The three endpoints lack the unit guard</p> <p>`routers/api/v1/api.go:1433-1437`:</p> <p>m.Get(&#34;/issue_templates&#34;, context.ReferencesGitRepo(), repo.GetIssueTemplates) m.Get(&#34;/issue_config&#34;, context.ReferencesGitRepo(), repo.GetIssueConfig) m.Get(&#34;/issue_config/validate&#34;, context.ReferencesGitRepo(), repo.ValidateIssueConfig) m.Get(&#34;/languages&#34;, reqRepoReader(unit.TypeCode), repo.GetLanguages) m.Get(&#34;/licenses&#34;, reqRepoReader(unit.TypeCode), repo.GetLicenses)</p> <p>`context.ReferencesGitRepo()` only opens the git repository — it performs no permission check. Every other endpoint in this group that reads Code-tree content is guarded with `reqRepoReader(unit.TypeCode)`: `/…</p> https://cve.radiocsirt.org/vuln/ghsa-3fwp-p5rj-2pxf https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1637 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um möglicherweise erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um möglicherweise erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1637