Description

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T17:17:28.860Z",
  "pubdate": "2026-08-13T17:17:28.860Z",
  "executiveSummary": "An incomplete patch implementation has been identified regarding the repository watch functionality, specifically where the initial fix applied via ClearRepoWatches was omitted from the API EditRepo code path. This architectural oversight introduces a security vulnerability affecting repository visibility transitions, specifically when an asset changes its access control posture from public to private.\nThe vulnerability manifests as an authorization logic flaw that allows stale watch relationships to persist improperly when a repository's privacy settings are modified. Consequently, unauthorized entities may retain active subscriptions or monitoring access to sensitive private resources that they should no longer be able to track.\nThe risk implications include unauthorized information disclosure regarding repository activity, commits, and internal updates. Attackers who previously established watch states on a public repository can maintain persistent visibility after the repository is transitioned to a private state, bypassing intended access restriction boundaries.\nExploitation requirements rely on the attacker having prior watcher status on the target repository before the visibility alteration occurs, combined with the administrative execution of the EditRepo API endpoint to transition the repository from public to private without proper state sanitization.",
  "technicalDetails": "The root cause of this vulnerability lies in inconsistent code path maintenance during security hardening. While the core remediation correctly implemented the ClearRepoWatches function to purge stale subscriptions during specific administrative updates, the parallel API EditRepo execution path failed to invoke this sanitization logic.\nThe vulnerable component resides within the repository management API controllers and backend logic governing repository update operations, specifically the EditRepo handler. When an administrative user or repository owner modifies repository settings via this API endpoint, the system updates the visibility attribute in the database without validating or flushing existing watcher associations.\nUnder normal security expectations, transitioning a repository from public to private should immediately invalidate and clear all active user watch entries to prevent unauthorized information leakage to non-collaborators. Because the API EditRepo path bypasses the ClearRepoWatches routine, these watch records remain intact in the database table.\nThe step-by-step attack flow proceeds as follows: First, an attacker establishes a legitimate watch relationship on a target repository while its visibility is set to public. Second, the repository owner or administrator invokes the vulnerable API EditRepo endpoint to change the repository status from public to private. Third, the backend updates the repository privacy flag but fails to execute ClearRepoWatches or equivalent state cleanup. Fourth, the attacker retains their active watcher subscription, allowing them to continue receiving notifications, activity stream updates, or data feeds associated with the now-private repository, effectively bypassing access control checks tied to repository visibility."
}