Executive brief
Gitea is a self-hosted service for managing software code and automated workflows. A security flaw in the organization-level management interface allows any member of an organization to view details about automated tasks (Actions) across all projects within that organization. This includes private projects that the user should not be able to see, potentially exposing sensitive information like internal project names, commit messages, and contributor identities.
Technical details
A Broken Object Property Level Authorization (BOPLA) vulnerability exists in Gitea's organization-level Actions REST endpoints (`/api/v1/orgs/{org}/actions/runs` and `/api/v1/orgs/{org}/actions/jobs`). The root cause is a missing per-repository access control check in the `shared.ListRuns` and `shared.ListJobs` handlers. While the API correctly verifies organization membership, the underlying database queries only filter by organization ID without joining against user permission tables. An authenticated attacker with basic organization membership can enumerate workflow runs, job statuses, commit SHAs, and branch names for every private repository in the organization, even those they are explicitly restricted from accessing. This issue is addressed in Gitea version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-05-24: disclosed: Vulnerability reported by Prakhar Porwal
- 2026-07-13: advisory: GitHub Advisory published
- 2026-07-21: patched: Fix released in version 1.27.0