https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:04:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352872 EUVD-2026-352872 https://cve.radiocsirt.org/vuln/euvd-2026-352872 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58437 <p>Repository Visibility Manipulation via Git Push Options</p> <p>Repository Visibility Manipulation via Git Push Options</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58437 https://cve.radiocsirt.org/vuln/ghsa-8p9h-49rc-qgxj <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Repository Visibility Manipulation via Git Push Options</p> <p>| Field | Value | |-------|-------| | **Affected File** | `routers/private/hook_post_receive.go` | | **Affected Function** | `HookPostReceive()` | | **Affected Lines** | 173–225 | | **Prerequisite** | Attacker must have owner-level or admin collaborator access to the target repository |</p> <p>---</p> <p>#### Description</p> <p>Gitea&#39;s post-receive git hook handler processes git push options — key-value pairs transmitted by a client during `git push` using the `-o` flag. Two undocumented push options, `repo.private` and `repo.template`, allow any user with repository owner or admin-collaborator access to toggle the visibility (`private/public`) and template status of a repository as a side effect of a normal git push.</p> <p>This capability was originally intended solely for the &#34;push-to-create&#34; feature (automatically creating a repo on first push). However, the options are processed without restriction on already-existing repositories, and — critically — the visibility change bypasses every control that a proper settings change would trigger:</p> <p>- No entry written to the repository&#39;s audit/activity log - No webhook event fired (`repository` event with `visibility_changed` action) - No org-level notification to owners - No team permission re-calculation - No email alert to watchers - The database update uses `UpdateRepositoryColsNoAutoTime`, which also suppresses the `updated_at` timestamp change</p> <p>---</p> <p>#### Vulnerable Code</p> <p>**`routers/priv…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Repository Visibility Manipulation via Git Push Options</p> <p>| Field | Value | |-------|-------| | **Affected File** | `routers/private/hook_post_receive.go` | | **Affected Function** | `HookPostReceive()` | | **Affected Lines** | 173–225 | | **Prerequisite** | Attacker must have owner-level or admin collaborator access to the target repository |</p> <p>---</p> <p>#### Description</p> <p>Gitea&#39;s post-receive git hook handler processes git push options — key-value pairs transmitted by a client during `git push` using the `-o` flag. Two undocumented push options, `repo.private` and `repo.template`, allow any user with repository owner or admin-collaborator access to toggle the visibility (`private/public`) and template status of a repository as a side effect of a normal git push.</p> <p>This capability was originally intended solely for the &#34;push-to-create&#34; feature (automatically creating a repo on first push). However, the options are processed without restriction on already-existing repositories, and — critically — the visibility change bypasses every control that a proper settings change would trigger:</p> <p>- No entry written to the repository&#39;s audit/activity log - No webhook event fired (`repository` event with `visibility_changed` action) - No org-level notification to owners - No team permission re-calculation - No email alert to watchers - The database update uses `UpdateRepositoryColsNoAutoTime`, which also suppresses the `updated_at` timestamp change</p> <p>---</p> <p>#### Vulnerable Code</p> <p>**`routers/priv…</p> https://cve.radiocsirt.org/vuln/ghsa-8p9h-49rc-qgxj https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304