Privilege escalation on forked repositories #9907

New Issue

GiteaMirror · 2025-11-02T08:52:48-06:00

GiteaMirror commented

2025-11-02 08:52:48 -06:00

Originally created by @penguineer on GitHub (Nov 29, 2022).

Description

We have a repository in an organisation that limits visibility to logged-in users. The repository itself is public (as the visibility is controlled by the organisation).

When a user forks this repository, the visibility is fixed to the original repository, i.e. it cannot be changed to private.
As a result, our protected repository has public visibility even without a login.

The bug reports addresses two aspects:

The visibility of the repository is extended and there is no way to make the forks private.
We only realized this by chance. The original repository is clearly protected and nobody expected the forks to be public. There needs to be a warning if privileges are extended on fork.

(I tried to reproduce this on the demo site, but setting up the required accounts was very cumbersome. I gave up after a dozen taken user names all followed by another go on the captcha.)

Gitea Version

1.16.8

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Gitea runs in a docker container. I believe this is not relevant to our problem.

Database

SQLite

Originally created by @penguineer on GitHub (Nov 29, 2022). ### Description We have a repository in an organisation that limits visibility to logged-in users. The repository itself is public (as the visibility is controlled by the organisation). When a user forks this repository, the visibility is fixed to the original repository, i.e. it cannot be changed to private. As a result, our protected repository has public visibility even without a login. The bug reports addresses two aspects: 1. The visibility of the repository is extended and there is no way to make the forks private. 2. We only realized this by chance. The original repository is clearly protected and nobody expected the forks to be public. There needs to be a warning if privileges are extended on fork. (I tried to reproduce this on the demo site, but setting up the required accounts was very cumbersome. I gave up after a dozen taken user names all followed by another go on the captcha.) ### Gitea Version 1.16.8 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Gitea runs in a docker container. I believe this is not relevant to our problem. ### Database SQLite

GiteaMirror added the type/bug label 2025-11-02 08:52:48 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9907