Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.27.0 | 1.27.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because the updateRepository function in services/repository/repository.go did not clear repository watches when a repository's visibility was changed from public to private via the API. This was a partial fix for a previous vulnerability (GHSA-8fwc-qjw5-rvgp), where the fix was only applied to the web UI path (MakeRepoPrivate) and not the API path (updateRepository). This allowed users who were watching a repository to continue to see its metadata after it was made private. The fix, identified in commit de4b8277e9cb576f2315fb03b5ab6478b42a1d31, was to add a call to repo_model.ClearRepoWatches in the updateRepository function, thus clearing the watches and preventing the information leak. The analysis identified the vulnerable function updateRepository and the functions in its call stack (UpdateRepository, Edit, updateBasicProperties) which are the entry points for the exploitation of this vulnerability.
updateRepositoryservices/repository/repository.go
UpdateRepositoryservices/repository/repository.go
Editrouters/api/v1/repo/repo.go
updateBasicPropertiesrouters/api/v1/repo/repo.go