repo collaborator can access all repositories of an organisation #9346

New Issue

GiteaMirror · 2025-11-02T08:36:03-06:00

GiteaMirror commented

2025-11-02 08:36:03 -06:00

Originally created by @init-rz on GitHub (Aug 4, 2022).

Description

create a new user "guest"
(with no assignment to an organization)

in an organization with multiple repos create a new repo "test"

add guest as collaborator to test with "read" right.

logout
login as guest
guest can see all repositories of the org.

expected: guest should only be able to see the test repo.

Gitea Version

1.17.0

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

downloaded windows binaries

Database

PostgreSQL

Originally created by @init-rz on GitHub (Aug 4, 2022). ### Description create a new user "guest" (with no assignment to an organization) in an organization with multiple repos create a new repo "test" add guest as collaborator to test with "read" right. logout login as guest guest can see all repositories of the org. expected: guest should only be able to see the test repo. ### Gitea Version 1.17.0 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? downloaded windows binaries ### Database PostgreSQL

GiteaMirror added the issue/needs-feedback type/bug labels 2025-11-02 08:36:03 -06:00

GiteaMirror closed this issue

2025-11-02 08:36:04 -06:00

GiteaMirror commented

2025-11-02 08:36:04 -06:00

@lunny commented on GitHub (Aug 7, 2022):

What's the organization's visibility? What's your other repositories' visibility?

@lunny commented on GitHub (Aug 7, 2022): What's the organization's visibility? What's your other repositories' visibility?

GiteaMirror commented

2025-11-02 08:36:04 -06:00

@init-rz commented on GitHub (Aug 8, 2022):

organisation: public

repositories: public

@init-rz commented on GitHub (Aug 8, 2022): organisation: public repositories: public

GiteaMirror commented

2025-11-02 08:36:05 -06:00

@lunny commented on GitHub (Aug 8, 2022):

public repository of public organization could be read by any user from that site.

@lunny commented on GitHub (Aug 8, 2022): public repository of public organization could be read by any user from that site.

GiteaMirror commented

2025-11-02 08:36:05 -06:00

@init-rz commented on GitHub (Aug 9, 2022):

thank you for the information.
this a bit confusing. what do you mean by "site" ?
i created the user -> user does not see any repository.
i added the user to the repository, not the organization -> user can see all repositories.

if this is as intended, then pls close the ticket and perhaps add this use case to the documentation.

thanks for the project and the good support.

@init-rz commented on GitHub (Aug 9, 2022): thank you for the information. this a bit confusing. what do you mean by "site" ? i created the user -> user does not see any repository. i added the user to the repository, not the organization -> user can see all repositories. if this is as intended, then pls close the ticket and perhaps add this use case to the documentation. thanks for the project and the good support.

GiteaMirror commented

2025-11-02 08:36:05 -06:00

@zeripath commented on GitHub (Aug 17, 2022):

What is the organisation visibility?

Is the Organisation PRIVATE, LIMITED or PUBLIC?

Is the User restricted?

@zeripath commented on GitHub (Aug 17, 2022): What is the organisation visibility? Is the Organisation PRIVATE, LIMITED or PUBLIC? Is the User `restricted`?

GiteaMirror commented

2025-11-02 08:36:05 -06:00

@zeripath commented on GitHub (Sep 4, 2022):

@init-rz we need some more information about this in order to determine if this is working as intended or if there is a bug.

@zeripath commented on GitHub (Sep 4, 2022): @init-rz we need some more information about this in order to determine if this is working as intended or if there is a bug.

GiteaMirror commented

2025-11-02 08:36:06 -06:00

@init-rz commented on GitHub (Sep 13, 2022):

sorry, for late reply.
yes everything was set to "public" (default when creating organization/repo)

@init-rz commented on GitHub (Sep 13, 2022): sorry, for late reply. yes everything was set to "public" (default when creating organization/repo)

GiteaMirror commented

2025-11-02 08:36:06 -06:00

@GiteaBot commented on GitHub (Sep 8, 2023):

We close issues that need feedback from the author if there were no new comments for a month. 🍵

@GiteaBot commented on GitHub (Sep 8, 2023): We close issues that need feedback from the author if there were no new comments for a month. :tea:

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9346