Gitea: Missing repository-unit authorization on issue-template API endpoints
Description
Missing authorization middleware on three Gitea API endpoints allows users with limited repository access to read Code-tree files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Missing authorization middleware on three Gitea API endpoints allows users with limited repository access to read Code-tree files.
Vulnerability
Three Gitea API endpoints (GET /repos/{owner}/{repo}/issue_templates, GET /repos/{owner}/{repo}/issue_config, and GET /repos/{owner}/{repo}/issue_config/validate) read files from the repository's Code default branch (.gitea/ISSUE_TEMPLATE/* and issue_config.yaml) but are registered without the reqRepoReader(unit.TypeCode) authorization middleware that other Code-tree endpoints use. The enclosing route group only checks for any repository unit access, so a user with access to a private repository via a non-Code unit (e.g., Issues) can reach these endpoints. This affects Gitea versions prior to the fix [1][2].
Exploitation
An attacker needs only valid credentials for a repository with any unit access (e.g., an organization team granted only the Issues unit). No Code permission is required. The attacker sends GET requests to the three vulnerable endpoints; the handlers return the contents of the issue template and config files from the Code default branch.
Impact
Successful exploitation results in unauthorized disclosure of issue template files and issue_config.yaml from the repository's Code tree. This may expose sensitive information embedded in those files, such as internal instructions, URLs, or configuration details, to users who should not have Code-level read access.
Mitigation
The vendor has released a patch; users should upgrade to the latest version of Gitea. No workaround is available. Refer to the advisory for the fixed version [1][2].
AI Insight generated on Jun 16, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing `reqRepoReader(unit.TypeCode)` authorization middleware on three issue-template API endpoints allows callers with only non-Code repository access to read Code-tree files."
Attack vector
An attacker who has access to a private repository through any single repository unit (e.g., an organization team granted only the Issues unit, with no Code access) can read the issue-template and issue-config files from that repository's Code default branch [ref_id=1][ref_id=2]. The attacker sends a GET request to `/api/v1/repos/{owner}/{repo}/issue_templates` (or `/issue_config` or `/issue_config/validate`) with a valid token that grants access to the repository but not the Code unit. The response returns the parsed contents of `.gitea/ISSUE_TEMPLATE/*` and `issue_config.yaml`, bypassing the unit-level authorization that should require Code-unit permission [CWE-862].
Affected code
The three API endpoints `GET /repos/{owner}/{repo}/issue_templates`, `GET /repos/{owner}/{repo}/issue_config`, and `GET /repos/{owner}/{repo}/issue_config/validate` in `routers/api/v1/api.go:1433-1437` are registered without the `reqRepoReader(unit.TypeCode)` authorization middleware that every sibling Code-tree endpoint carries. The handlers in `routers/api/v1/repo/repo.go` (`GetIssueTemplates` at line 1179, `GetIssueConfig` at line 1209) read `.gitea/ISSUE_TEMPLATE/*` and `issue_config.yaml` from the default Code branch and return their contents via the API response.
What the fix does
The fix adds `reqRepoReader(unit.TypeCode)` as a middleware to the three unprotected endpoints in `routers/api/v1/api.go`, matching the guard already present on sibling Code-tree endpoints like `/languages` and `/licenses` [ref_id=1][ref_id=2]. This ensures that only callers who have been granted the Code unit permission for the repository can invoke these handlers. Without this guard, the enclosing group's `repoAssignment()` check only verifies access to *any* repository unit, which is insufficient for endpoints that read Code-tree content.
Preconditions
- authThe attacker must have a valid authentication token for a Gitea account that has access to the target private repository through at least one repository unit (e.g., Issues unit) but not the Code unit.
- configThe target repository must be private and have `.gitea/ISSUE_TEMPLATE/*` or `issue_config.yaml` files on its default branch.
- networkThe attacker must be able to send HTTP requests to the Gitea API endpoint.
Generated on Jun 16, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.