GHSA-frpw-3h2q-4jj6: Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Author: Prakhar Porwal Date: 2026-05-24 Target: Gitea (self-hosted Git service) Branch tested: main @ b7e95cc48c (development build, go1.26.3) Component: routers/api/v1/org/action.go (org-level Actions API) OWASP: API3:2023 Broken Object Property Level Authorization 1. Summary The org-level Actions REST endpoints GET /api/v1/orgs/{org}/actions/runs GET /api/v1/orgs/{org}/actions/jobs are gated only by reqOrgMembership() + reqToken(). They then call shared.ListRuns(ctx, ctx.Org.Organization.ID, 0) / shared.ListJobs(ctx, ctx.Org.Organization.ID, 0, 0, nil), which selects every action_run / action_run_job row whose repository belongs to the org — with no per-repository ACL check. Result: any user who is a member of an organization can enumerate workflow runs and jobs from every repository in that org, including: - private repositories the caller has no team membership for, - repositories where the caller has been explicitly denied the repo.actions unit, - repositories created by other teams the caller is not part of. Direct per-repo equivalents (GET /api/v1/repos/{owner}/{repo}/actions/runs, …/jobs/{job_id}/logs, …/runs/{run_id}/jobs) correctly return 404 for the same caller — proving the org-level surface is the only path that leaks. 2. Affected Code 2.1 Route registration routers/api/v1/api.go:1647-1652 addActionsRoutes( m, reqOrgMembership(), // reqReaderCheck reqOrgOwnership(), // reqOwnerCheck org.NewAction(), ) 2.2 Helper that registers run/job listing routers/api/v1/api.go:908-941 m.Group("/runs", reqToken(), reqReaderCheck, act.ListWorkflowRuns) m.Get("/runs", reqToken(), reqReaderCheck, act.ListWorkflowRuns) m.Get("/jobs", reqToken(), reqReaderCheck, act.ListWorkflowJobs) reqReaderCheck for org-scope = reqOrgMembership() — bare org membership is enough; no per-repo permission is consulted. 2.3 Handler routers/api/v1/org/action.go:595-683 func (Action) ListWorkflowJobs(ctx *context.APIContext) { shared.ListJobs(ctx, ctx.Org.Organization.ID, 0,