CVE-2019-11576:
Gitea Allows 1FA Even for 2FA-Enrolled Accounts
9.8
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.59775%
CWE
Published
5/24/2022
Updated
4/24/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.8.0 | 1.8.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from missing 2FA enforcement in API authentication flows. The GitHub PRs #6674/6676 show critical changes adding OTP checks to API context handlers. Specifically:
- routers/api/v1/api.go's ctxUser was modified to include 2FA verification
- modules/context/api.go's APIContext was updated to handle 2FA requirements These changes indicate the previous absence of 2FA checks in these authentication pathways, allowing 1FA-only access to 2FA-enabled accounts via API endpoints.