Description

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-13T17:17:27.157Z",
  "pubdate": "2026-08-13T17:17:27.157Z",
  "executiveSummary": "A vulnerability has been identified in code.gitea.io/gitea involving Missing Authorization, Authorization Bypass Through User-Controlled Key, Incorrect Permission Assignment for Critical Resource, and Exposure of Sensitive Information to an Unauthorized Actor.\nThis flaw allows remote attackers to bypass intended security controls, access restricted critical resources, and exfiltrate sensitive information without proper authentication or authorization.\nThe affected product is code.gitea.io/gitea, impacting systems relying on its permission assignment and access control mechanisms.\nThe risk implications are severe, as unauthorized actors can manipulate user-controlled keys to escalate access privileges and compromise confidentiality and integrity.\nAttackers require network access to the target Gitea instance and the ability to supply or manipulate user-controlled keys to trigger the authorization bypass and execute unauthorized operations against critical resources.",
  "technicalDetails": "The root cause of the vulnerability stems from a combination of missing authorization checks, improper handling of user-controlled keys, and incorrect permission assignments within code.gitea.io/gitea.\nThe vulnerable components are responsible for enforcing access control policies on critical resources and restricting sensitive data exposure.\nDue to the absence of robust validation mechanisms, an unauthenticated or low-privileged attacker can supply manipulated keys or parameters to bypass access restrictions.\nThe step-by-step attack flow begins with the attacker identifying endpoints or critical resources in code.gitea.io/gitea that process user-supplied keys or identifiers without adequate authorization verification.\nThe attacker crafts a malicious request containing a targeted user-controlled key designed to deceive the permission assignment logic.\nUpon receiving the request, the vulnerable application fails to validate whether the requester possesses the necessary privileges to access the requested resource.\nInstead, the flawed logic incorrectly assigns permissions based on the untrusted input, granting the attacker unauthorized access.\nThis behavior leads directly to the exposure of sensitive information to unauthorized actors and permits the execution of unauthorized actions against critical resources.\nNetwork exposure is present as the application services requests over standard protocols.\nPost-exploitation impact includes unauthorized data disclosure, potential manipulation of critical system resources, and further compromise of the underlying Gitea deployment."
}