Описание
Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.
Ссылки
- Release Notes
- Issue TrackingPatch
- Release Notes
- Broken Link
Уязвимые конфигурации
Конфигурация 1Версия до 1.25.4 (исключая)
cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*
EPSS
Процентиль: 2%
0.00013
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-200
Связанные уязвимости
CVSS3: 6.5
debian
2 месяца назад
Gitea's notification API does not re-validate repository access permis ...
EPSS
Процентиль: 2%
0.00013
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-200