Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.27.0 | 1.27.0 |
Miggo AIRoot Cause AnalysisThe analysis of the security advisory and the associated commit c9920b7bd0f6ec1f7590f104711b09d55917f9e8 clearly pinpoints the vulnerability to the IntrospectOAuth function located in routers/web/auth/oauth2_provider.go. The vulnerability description explicitly details the flaw: the function checks the credentials of the client making the introspection request but fails to authorize that client against the token's intended audience. An authenticated client could therefore introspect tokens issued to any other OAuth application on the same Gitea instance, gaining access to token metadata. The provided patch confirms this by introducing a crucial authorization check: if grant == nil || grant.ApplicationID != introspectingApp.ID. This line ensures that the application ID associated with the token's grant (grant.ApplicationID) is the same as the ID of the authenticated client making the request (introspectingApp.ID). If there is a mismatch, the function now returns an inactive response, effectively closing the information disclosure vulnerability. The added integration test testOAuthIntrospectionCrossClientIsolation further validates that this was the intended fix for the cross-client information leak.
IntrospectOAuthrouters/web/auth/oauth2_provider.go