When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified.
Transfer-granted access is now removed while collaborations that existed before the transfer are preserved.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Gitea Gitea
cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*
|
— |
28.0.0
|
References 4
https://github.com/go-gitea/gitea/security/advisories/GHSA-xfqq-h54g-92f8
GitHub Security Advisory GHSA-xfqq-h54g-92f8
https://github.com/go-gitea/gitea/pull/39042
Fix: go-gitea/gitea pull request #39042
https://blog.gitea.com/release-of-28.0.0/
Gitea 28.0.0 release announcement
https://github.com/go-gitea/gitea/releases/tag/v28.0.0
go-gitea/gitea v28.0.0 release