github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-09 12:46:42 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

New commit status API doesn't check permissions properly #9213

New Issue
Closed
opened 2025-11-02 08:32:20 -06:00 by GiteaMirror · 3 comments
GiteaMirror commented 2025-11-02 08:32:20 -06:00
Owner
Copy Link

Originally created by @leytilera on GitHub (Jul 12, 2022).

Description

Using the Gitea API it is currrently possible with the new commit status endpoint to add a commit status to a repository, even if you don't have write access to that repository. This function does not check, if the user has access to the repository.

Gitea Version

from 1.16.8 to 1.18.0+dev-90-gc8e0fd0bc

Can you reproduce the bug on the Gitea demo site?

Yes

Originally created by @leytilera on GitHub (Jul 12, 2022). ## Description Using the Gitea API it is currrently possible with the new commit status endpoint to add a commit status to a repository, even if you don't have write access to that repository. [This function](https://github.com/go-gitea/gitea/blob/main/routers/api/v1/repo/status.go#L21) does not check, if the user has access to the repository. ## Gitea Version from 1.16.8 to 1.18.0+dev-90-gc8e0fd0bc ## Can you reproduce the bug on the Gitea demo site? Yes
GiteaMirror added the type/bug label 2025-11-02 08:32:20 -06:00
GiteaMirror commented 2025-11-02 08:32:20 -06:00
Author
Owner
Copy Link

@zeripath commented on GitHub (Jul 12, 2022):

Thank you for reporting this, but in future please report issues like this directly to security@gitea.io .

NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue.

By opening a public issue like this you've advertised this issue to everyone reading the bug tracker before we have had a chance to fix this or release a fixed version.

@zeripath commented on GitHub (Jul 12, 2022): Thank you for reporting this, but in future please report issues like this directly to security@gitea.io . > NOTE: If your issue is a security concern, please send an email to [security@gitea.io](mailto:security@gitea.io) instead of opening a public issue. By opening a public issue like this you've advertised this issue to everyone reading the bug tracker before we have had a chance to fix this or release a fixed version.
GiteaMirror commented 2025-11-02 08:32:21 -06:00
Author
Owner
Copy Link

@6543 commented on GitHub (Jul 12, 2022):

@leytilera **PLEASE follow SECURITY.md next time

& thanks for reporting

@6543 commented on GitHub (Jul 12, 2022): @leytilera **PLEASE follow [SECURITY.md](https://github.com/go-gitea/gitea/blob/main/SECURITY.md) next time & thanks for reporting
GiteaMirror commented 2025-11-02 08:32:21 -06:00
Author
Owner
Copy Link

@6543 commented on GitHub (Jul 12, 2022):

also would you like to be mentioned in the https://blog.gitea.io ?

@6543 commented on GitHub (Jul 12, 2022): also would you like to be mentioned in the https://blog.gitea.io ?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label type/bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#9213
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?