Email Management API Credential Bypass via Feature Restriction

Executive Summary

This vulnerability affects Gitea versions up to 1.26.4. It involves API endpoints for managing email addresses that bypass credential-management restrictions set by administrators. While the web interface correctly enforces these restrictions, the API endpoints POST /api/v1/user/emails and DELETE /api/v1/user/emails remain accessible, allowing unauthorized users to add or remove email addresses despite controls being in place.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a version up to 1.26.4. Verify if API endpoints POST /api/v1/user/emails and DELETE /api/v1/user/emails are accessible even when credential management is disabled for externally authenticated users. Review logs for unauthorized email modifications via these endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to modify email addresses even when administrators have disabled credential management for externally authenticated users. Attackers could add or remove email addresses, potentially gaining access to accounts or disrupting communications. The impact is limited to data integrity and confidentiality, not system availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized changes in user email addresses, potentially violating compliance requirements for data integrity and access controls. Organizations using Gitea with external authentication may face risks of non-compliance with GDPR, HIPAA, or other standards that mandate strict access restrictions and auditability of user data modifications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to a version beyond 1.26.4 where the vulnerability is patched. Ensure API endpoints enforce the same credential-management restrictions as the web interface. Review and restrict access to email management APIs if external authentication is used.

Useful 0 Not Useful 0