fkie_cve-2026-58507

Private Repository Existence Disclosure via go-get Meta Endpoint

GHSA-p4mj-98mv-xq26 — Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

Affected: Go: code.gitea.io/gitea

| Field | Value | |-------|-------| | **Affected File** | `routers/web/repo/githttp.go`, `services/context/repo.go` | | **Affected Functions** | `httpBase()`, `EarlyResponseForGoGetMeta()` | | **Affected Lines** | `githttp.go:63–66`, `services/context/repo.go:374–396` | | **Prerequisite** | None — fully unauthenticated |

---

#### Description

Gitea implements a special behavior for requests containing the `?go-get=1` query parameter. This parameter is sent by the Go toolchain (`go get`, `go install`) to discover VCS metadata for module imports. When Gitea detects this parameter in the HTTP request path for a repository, it bypasses the normal authentication and authorization stack and returns an HTTP 200 response containing `<meta name="go-import">` and `<meta name="go-source">` tags — regardless of whether:

- The repository is private - The requesting user is authenticated - The requesting user has any permission on the repository

The entry point is `routers/web/repo/githttp.go:63–66`:

```go func httpBase(ctx *context.Context, optGitService ...string) *serviceHandler { reponame := strings.TrimSuffix(ctx.PathParam("reponame"), ".git")

if ctx.FormString("go-get") == "1" { context.EarlyResponseForGoGetMeta(ctx) return nil // ← returns before any auth or permission check } ... ```

The `EarlyResponseForGoGetMeta` function (`services/context/repo.go:379–396`) is called unconditionally, and the function's own docstring documents the intende…

Most recent entries from all

fkie_cve-2026-58507

GHSA-p4mj-98mv-xq26 — Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint