Executive brief
Gitea, a popular self-hosted Git service, contains a flaw that allows anyone on the internet to confirm the existence of private code repositories. By using a specific technical request parameter intended for the Go programming language toolchain, an unauthorized user can bypass security checks to see repository names, owner details, and internal branch names. While this does not grant direct access to the source code itself, it allows attackers to map out a company's internal infrastructure and identify sensitive projects for targeted attacks.
Technical details
An information disclosure vulnerability exists in Gitea's handling of the 'go-get' metadata endpoint. The application implements a workaround for the Go toolchain in 'routers/web/repo/githttp.go' and 'services/context/repo.go' that calls 'EarlyResponseForGoGetMeta()' before the standard authentication and authorization stack is executed. An unauthenticated remote attacker can append '?go-get=1' to any repository URL to receive an HTTP 200 response containing '<meta>' tags that reveal the repository's existence, its full clone URL, and the default branch name. This bypasses private repository visibility settings and allows for large-scale enumeration of internal projects. The issue is resolved in version 1.27.0 by ensuring authentication is verified for private repositories before returning Go metadata.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: advisory: Initial GitHub Advisory published
- 2026-07-21: patched: Advisory updated and fix confirmed in version 1.27.0