Description

Private Repository Metadata Remains Accessible After Access Revocation

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T17:17:27.377Z",
  "pubdate": "2026-08-13T17:17:27.377Z",
  "executiveSummary": "This vulnerability involves an access control failure where private repository metadata remains accessible even after user access revocation.\nThe primary impact is the unauthorized exposure of sensitive repository metadata to unauthorized or former users.\nAffected systems include repositories utilizing metadata caching or improper state synchronization upon permission changes.\nThe risk implications include potential reconnaissance, leakage of proprietary project structures, and exposure of sensitive configuration details that could facilitate further attacks.\nAn attacker with previous repository access or knowledge of target identifiers can exploit this flaw without requiring complex privileges, assuming the system fails to invalidate cached authorization states or session tokens.\nExploitation requirements typically involve targeting specific repository endpoints after permissions have been actively revoked, highlighting a desynchronization between access control lists and underlying metadata storage layers.",
  "technicalDetails": "The root cause of this vulnerability stems from improper state management within the access control architecture, specifically the failure to invalidate cached repository metadata or update authorization enforcement layers when user permissions are revoked.\nThe vulnerable component is the metadata retrieval subsystem, which handles queries regarding repository properties, configuration states, and structural information.\nExploitation occurs when a user or client whose access has been explicitly revoked sends a direct request to repository metadata endpoints.\nBecause authorization checks may rely on stale cache entries or fail to re-evaluate the caller's current permission state against the database of record, the system erroneously processes the request and returns the private metadata payload.\nThe attack flow proceeds as follows: First, a user has legitimate access to a private repository and caches or interacts with its metadata. Second, an administrator revokes the user's access privileges. Third, the attacker bypasses standard UI restrictions by querying direct application programming interface endpoints or using previously captured identifiers. Fourth, the backend subsystem processes the request without performing a strict, real-time authorization validation against the updated access control list. Finally, the server responds with the sensitive private repository metadata.\nAuthentication requirements vary, but the vulnerability is particularly dangerous when previously authorized users retain valid session identifiers that are not invalidated during permission updates. Privilege requirements are effectively bypassed due to the flawed state synchronization.\nNetwork exposure is standard over HTTP/HTTPS protocols utilized by the repository hosting platform.\nPost-exploitation impact includes the aggregation of internal project names, contributor lists, branch structures, and potentially sensitive environment variables or dependency configurations embedded within the metadata, which can be leveraged for subsequent targeted attacks."
}