Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the failure to enforce 'public-only' token scopes across various API endpoints, particularly those related to teams. This allowed a token with restricted scope to access private repository metadata and activity feeds. The analysis of the patch commits reveals that the fix involved adding explicit checks for the 'public-only' scope in several API handlers and their underlying data-access functions. Specifically, the functions GetTeamRepos, GetTeamRepo, and ListTeamActivityFeeds in routers/api/v1/org/team.go were modified to filter out private data when a public-only token is used. The GetTeamRepositories function in models/repo/org_repo.go was updated to include a condition to filter by is_private=false. Additionally, GetUserOrgsPermissions in routers/api/v1/org/org.go was patched to prevent information disclosure about private organizations. These changes ensure that public-only tokens can only access public resources, mitigating the information disclosure vulnerability.
repo.GetTeamRepositoriesmodels/repo/org_repo.go
org.GetTeamReposrouters/api/v1/org/team.go
org.GetTeamReporouters/api/v1/org/team.go
org.ListTeamActivityFeedsrouters/api/v1/org/team.go
org.GetUserOrgsPermissionsrouters/api/v1/org/org.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gitea.dev | go | < 1.27.0 | 1.27.0 |