Stored Repository Deletion in GitHub Enterprise

Executive Summary

This vulnerability allows an attacker with a public-only scoped token to delete private repositories in a public organization. The DELETE /api/v1/orgs/{org}/repos endpoint does not enforce public-only token restrictions properly, only checking if the organization is public rather than the repositories themselves.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Gitea versions between 1.27.0 and 28.2.0. Review logs for DELETE requests to /api/v1/orgs/{org}/repos. Verify if public-only tokens were used for such requests. Inspect repository deletion events in public organizations owned by token holders.

Useful 0 Not Useful 0

Impact Analysis

If you own a public organization in Gitea and your public-only token is compromised, an attacker could permanently delete your private repositories. This could lead to data loss and disruption of services relying on those repositories.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized deletion of private repositories, potentially violating data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule on integrity and access controls). Unauthorized deletion of private repositories may result in loss of critical data, including sensitive or protected health information, compromising compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to a version beyond 28.2.0. Review and revoke any public-only tokens issued to organization owners. Implement additional access controls to restrict repository deletion permissions. Monitor for unauthorized repository deletions in public organizations.

Useful 0 Not Useful 0