Executive Summary

This vulnerability exists in Gogs, an open source self-hosted Git service, in version 0.14.3 and earlier. It allows any authenticated user to watch a private repository they do not have access to because of an inverted access check in the Watch API handler.

Specifically, the code incorrectly checks if the user can read the repository by using repoCtx.ViewerCanRead(), which returns a 404 error when the user can read, instead of checking if the user cannot read (!repoCtx.ViewerCanRead()) to return the 404 error. This logic flaw lets unauthorized users watch private repositories.

Once watching the private repository, the attacker’s dashboard activity feed displays sensitive information such as commit messages, branch names, issue titles, and pull request details from that private repository. Additionally, if email notifications are enabled, the attacker receives emails containing issue and comment content.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information from private repositories. An attacker who exploits this flaw can view commit messages, branch names, issue titles, and pull request details that should be restricted.

Moreover, if email notifications are enabled, the attacker can receive emails containing issue and comment content, further exposing confidential data.

This exposure can compromise the confidentiality of proprietary or sensitive project information, potentially leading to information leakage, intellectual property theft, or other security risks.

Useful 0 Not Useful 0