CVE-2022-38183

Root

Cause

Gitea versions prior to 1.16.9 lacked proper permission checks when users added existing issues to projects. Specifically, the server did not verify that the issue belonged to the same repository as the project, nor that the current user had access to the issue. This allowed any authenticated user to assign any issue—regardless of its visibility—to any project [1][4].

Exploitation

An attacker could exploit this by sending a crafted POST request to the /issues/projects endpoint, supplying the target issue ID and project ID. The request required a valid CSRF token but no additional authorization. The advisory from usd HeroLab includes a proof-of-concept demonstrating assignment of a private issue (ID 7) to an attacker's project (ID 3) [4].

Impact

Successful exploitation gave the attacker read access to the title of any private issue in the Gitea instance. While the full body remained hidden, the title alone could leak sensitive project information. The vulnerability is rated medium severity due to the partial disclosure [1][4].

Mitigation

The issue was addressed in Gitea version 1.16.9, which introduced checks ensuring the issue's repository ID matches the project's repository ID and that the user has appropriate permissions [2]. Users are advised to upgrade to this version or later. No workaround exists for earlier releases.