Listen to this Post
The vulnerability resides in the authorization logic for the `/repos/{owner}/{repo}/releases/{id}` API endpoint responsible for deleting releases. Gitea’s permission model is based on repository access levels (None, Read, Write, Admin). Deleting a release should require at least Write permission to the repository. The flawed check incorrectly validates the actor’s permissions against the organization owning the repository, rather than against the specific target repository itself. An attacker with Write permissions to any repository within an organization could craft an HTTP DELETE request to this endpoint, specifying the ID of a release belonging to a different repository under the same organization where they only have Read or No access. The system erroneously grants the deletion request because it finds the user has adequate rights at the organizational level, bypassing the repository-specific authorization check. This allows unauthorized deletion of release assets and metadata.
Platform: Gitea
Version: < 1.25.2
Vulnerability: Authorization Bypass
Severity: Moderate
date: 2025-12-26
Prediction: 2025-12-26
What Undercode Say:
curl -X DELETE -H "Authorization: token $USER_TOKEN" https://gitea.example.com/api/v1/repos/victim-org/critical-repo/releases/123 Returns 204 No Content despite lacking repo write access.
Check local Gitea version gitea --version | grep -oE '1.2[0-5].[0-9]+'
How Exploit:
- Attacker obtains Write access to any org repo.
2. Attacker enumerates release IDs in target repo.
3. Attacker sends crafted DELETE request.
4. Release is deleted without proper authorization.
Protection from this CVE
Upgrade to Gitea 1.25.2 or later. Implement network ACLs to restrict API access. Audit release deletion logs for unauthorized activity.
Impact:
Unauthorized deletion of software releases, potentially disrupting deployment pipelines and causing loss of distribution artifacts.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
