CVE-2021-45326

Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability exists in Gitea API routes prior to version 1.5.2. The API endpoints that accept state-changing POST requests do not require a CSRF token, allowing an attacker to forge requests on behalf of an authenticated user [1][3].

Exploitation

An attacker can exploit this by crafting a malicious website, email, or link that, when visited by an authenticated Gitea user, triggers an unwanted API call (e.g., via an HTML form or image tag). Since the victim's browser automatically sends session cookies, the forged request is processed by Gitea as legitimate. No special network position or additional privileges are required beyond the victim being logged in [1][3].

Impact

Successful exploitation allows the attacker to execute arbitrary state-changing operations on the victim's behalf, such as creating, modifying, or deleting repositories, issues, or user settings. The integrity of the Gitea instance is compromised, and confidentiality may be affected if the API returns sensitive data in responses [1][3].

Mitigation

Upgrade to Gitea version 1.5.2 or later, released on October 2, 2018, which enforces CSRF token validation on API routes [1][3]. If upgrading is not immediately possible, consider implementing additional CSRF protections, such as SameSite cookie attributes or custom middleware, though no official workaround is provided by the vendor.