Description

Repository Visibility Manipulation via Git Push Options

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T17:17:27.703Z",
  "pubdate": "2026-08-13T17:17:27.703Z",
  "executiveSummary": "This vulnerability involves repository visibility manipulation via Git push options, presenting significant security risks to affected systems and products by allowing unauthorized alteration of repository access settings.\nThe core vulnerability type enables attackers with specific capabilities to bypass intended access controls or visibility configurations.\nThe potential impact includes unauthorized exposure or restriction of sensitive source code and proprietary assets, leading to severe data confidentiality or integrity breaches.\nAffected systems involve Git server implementations or repository management platforms that process specially crafted push options during the git push operation.\nRisk implications encompass unauthorized intellectual property exposure, compliance violations, and potential reconnaissance facilitation for subsequent attacks.\nAttacker capabilities require authenticated access to the target repository and the ability to leverage git push options to alter administrative or visibility parameters during the push lifecycle.\nExploitation requirements typically necessitate interaction with the vulnerable Git server endpoint using standard Git client tooling configured with malicious or unintended push option arguments.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation and sanitization of Git push options received by the server-side Git hooks or repository management daemon.\nWhen a client executes a git push command utilizing the --push-option flag, the server parses these parameters to execute ancillary actions or update repository metadata.\nThe vulnerable component is the parameter parsing and state-updating logic that handles incoming push options without enforcing strict authorization checks against the user's actual permission level for modifying repository-level settings such as visibility.\nNetwork exposure is present wherever the Git server accepts push operations over protocols such as HTTPS, SSH, or the Git native protocol.\nAuthentication requirements dictate that the attacker must possess valid credentials to authenticate against the target repository, though privilege requirements are bypassed if low-privileged users can supply administrative push options.\nThe exploitation method proceeds via a step-by-step attack flow: First, the attacker establishes a connection to the remote Git repository using an authorized client session. Second, the attacker formulates a git push command incorporating specific, unauthorized push options designed to toggle the repository visibility state from private to public or vice versa. Third, the server receives the push payload and accompanying options, executing the backend routine to update the repository configuration database without adequately verifying if the authenticated identity holds administrative privileges to alter visibility states. Finally, the repository state is mutated, achieving the unauthorized visibility manipulation.\nPost-exploitation impact includes the immediate exposure of private repositories containing sensitive code, secrets, or internal documentation to unauthorized users or the public internet, or conversely, the unintended occlusion of public repositories leading to denial of service for dependent workflows."
}