CVE-2020-13246

Root

Cause In Gitea versions up to 1.11.5, the function handling the transfer of repository ownership between organizations could trigger a deadlock. The issue arises from improper synchronization when retrieving organization teams during the transfer process, leading to a waitgroup counter mismatch and a server panic [1][2].

Attack

Vector An authenticated user who has the ability to initiate a repository ownership transfer from one organization to another can exploit this vulnerability. No special privileges beyond basic repository transfer permissions are required. The attack consists of simply starting the transfer operation, which causes the server to become unresponsive [2].

Impact

When the deadlock is triggered, the Gitea server becomes completely frozen, failing to process any further requests. In the log excerpt provided by the reporter, the server enters a state where it must be forcefully shut down (hammered) and restarted, resulting in a denial of service [2]. The panic message sync: negative WaitGroup counter confirms a concurrency bug [2].

Mitigation

The vulnerability was addressed in Gitea version 1.11.6. The fix is contained in pull request #11438, which modified how organization teams are retrieved during ownership transfers, using sessions to avoid the deadlock condition [3]. Users running Gitea versions through 1.11.5 should upgrade immediately to a patched release.