-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.22.3 | 1.22.3 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in Gitea's API authorization logic, which failed to consistently enforce token scopes intended to restrict access to public resources only. The core of the issue was an incomplete and fragmented implementation of the scope-checking mechanism.
The initial implementation, primarily within the reqToken and tokenRequiresScopes functions in routers/api/v1/api.go, only partially handled the public-only restriction, with checks limited to repositories and organizations. Other resources like packages, issues, and users were not covered, allowing a user with a public-only scoped API token to access private resources of these types.
Furthermore, several API endpoint functions responsible for searching or listing resources (e.g., SearchIssues, Search for repos, GetAll for orgs) did not correctly filter their results based on the token's scope. They would often return private or limited-visibility resources as long as the user was authenticated, ignoring the more restrictive scope of the token being used.
The patch addresses this vulnerability by introducing a centralized and more robust checking mechanism. A new middleware, checkTokenPublicOnly, is created to perform a comprehensive check across all relevant resource types. This middleware is then applied to all applicable API routes. The APIContext is enhanced with a PublicOnly boolean flag, which is set by the tokenRequiresScopes function and used by the new middleware and the endpoint functions themselves to correctly filter data. This ensures that any request made with a public-only token is properly restricted to accessing only public resources across the entire API surface.
reqPackageAccessrouters/api/packages/api.go
reqTokenrouters/api/v1/api.go
GetAllrouters/api/v1/org/org.go
SearchIssuesrouters/api/v1/repo/issue.go
Searchrouters/api/v1/repo/repo.go
Searchrouters/api/v1/user/user.go
tokenRequiresScopesrouters/api/v1/api.go