Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.27.0 | 1.27.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the incorrect authorization checks for public-only personal access tokens (PATs) when accessing repositories or packages owned by users or organizations with Limited visibility. The affected functions were using IsPrivate() to check for visibility, which evaluates to false for Limited visibility, thus bypassing the intended restrictions of the public-only scope. An attacker with a public-only token could access repositories and packages that were not public, but internal to the Gitea instance. The fix, identified in commit de4b8277e9cb576f2315fb03b5ab6478b42a1d31, replaces the IsPrivate() checks with !IsPublic(). This ensures that public-only tokens can only access resources that are truly public, and not those with Limited or Private visibility, correctly enforcing the security model.
checkTokenPublicOnlyrouters/api/v1/api.go
reqPackageAccessrouters/api/packages/api.go
TokenCanAccessReposervices/context/api.go
CheckTokenScopesservices/context/permission.go