GHSA-8p9h-49rc-qgxj: Gitea: Repository Visibility Manipulation via Git Push Options

Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | Affected File | routers/private/hook_post_receive.go | | Affected Function | HookPostReceive() | | Affected Lines | 173–225 | | Prerequisite | Attacker must have owner-level or admin collaborator access to the target repository | Description Gitea's post-receive git hook handler processes git push options — key-value pairs transmitted by a client during git push using the -o flag. Two undocumented push options, repo.private and repo.template, allow any user with repository owner or admin-collaborator access to toggle the visibility (private/public) and template status of a repository as a side effect of a normal git push. This capability was originally intended solely for the "push-to-create" feature (automatically creating a repo on first push). However, the options are processed without restriction on already-existing repositories, and — critically — the visibility change bypasses every control that a proper settings change would trigger: - No entry written to the repository's audit/activity log - No webhook event fired (repository event with visibility_changed action) - No org-level notification to owners - No team permission re-calculation - No email alert to watchers - The database update uses UpdateRepositoryColsNoAutoTime, which also suppresses the updated_at timestamp change Vulnerable Code **routers/private/hook_post_receive.go:173–225** isPrivate := opts.GitPushOptions.Bool(private.GitPushOptionRepoPrivate) // "repo.private" isTemplate := opts.GitPushOptions.Bool(private.GitPushOptionRepoTemplate) // "repo.template" if isPrivate.Has() || isTemplate.Has() { // ... loads repo and verifies pusher is owner or admin ... if !perm.IsOwner() && !perm.IsAdmin() { ctx.JSON(http.StatusNotFound, ...) return } // FIXME: these options are not quite right, for example: changing visibility // should do more works than just setting the is_private flag // These options sh