Cross-Repository IDOR in GitHub Issue Dependency Removal

Executive Summary

This is a cross-repository Insecure Direct Object Reference (IDOR) vulnerability in Gitea. It allows an attacker with write access to a repository to remove dependencies and inject comments into private repositories they cannot access. The issue occurs because the 'remove dependency' function lacks proper permission checks when dealing with cross-repository dependencies.

Useful 0 Not Useful 0

Detection Guidance

Check Gitea logs for suspicious cross-repository dependency removal actions or unauthorized comments. Look for requests targeting private repositories from users without explicit access. Review Gitea version to confirm if it is below 1.27.0.

Useful 0 Not Useful 0

Impact Analysis

An attacker could tamper with private repositories by removing dependencies and adding malicious comments. This requires the attacker to know the global numeric ID of a private repository's issue with a dependency link to one of their issues. The impact is moderate but allows unauthorized writes across repository boundaries.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later to apply the patch. Monitor repository activity for unauthorized dependency removals or comments. Restrict write access to repositories where possible.

Useful 0 Not Useful 0