https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 20:57:56 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-58437 <p>Repository Visibility Manipulation via Git Push Options</p> <p>Repository Visibility Manipulation via Git Push Options</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-58437 https://vulnerability.circl.lu/vuln/ghsa-8p9h-49rc-qgxj <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Repository Visibility Manipulation via Git Push Options</p> <p>| Field | Value | |-------|-------| | **Affected File** | `routers/private/hook_post_receive.go` | | **Affected Function** | `HookPostReceive()` | | **Affected Lines** | 173–225 | | **Prerequisite** | Attacker must have owner-level or admin collaborator access to the target repository |</p> <p>---</p> <p>#### Description</p> <p>Gitea&#39;s post-receive git hook handler processes git push options — key-value pairs transmitted by a client during `git push` using the `-o` flag. Two undocumented push options, `repo.private` and `repo.template`, allow any user with repository owner or admin-collaborator access to toggle the visibility (`private/public`) and template status of a repository as a side effect of a normal git push.</p> <p>This capability was originally intended solely for the &#34;push-to-create&#34; feature (automatically creating a repo on first push). However, the options are processed without restriction on already-existing repositories, and — critically — the visibility change bypasses every control that a proper settings change would trigger:</p> <p>- No entry written to the repository&#39;s audit/activity log - No webhook event fired (`repository` event with `visibility_changed` action) - No org-level notification to owners - No team permission re-calculation - No email alert to watchers - The database update uses `UpdateRepositoryColsNoAutoTime`, which also suppresses the `updated_at` timestamp change</p> <p>---</p> <p>#### Vulnerable Code</p> <p>**`routers/priv…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Repository Visibility Manipulation via Git Push Options</p> <p>| Field | Value | |-------|-------| | **Affected File** | `routers/private/hook_post_receive.go` | | **Affected Function** | `HookPostReceive()` | | **Affected Lines** | 173–225 | | **Prerequisite** | Attacker must have owner-level or admin collaborator access to the target repository |</p> <p>---</p> <p>#### Description</p> <p>Gitea&#39;s post-receive git hook handler processes git push options — key-value pairs transmitted by a client during `git push` using the `-o` flag. Two undocumented push options, `repo.private` and `repo.template`, allow any user with repository owner or admin-collaborator access to toggle the visibility (`private/public`) and template status of a repository as a side effect of a normal git push.</p> <p>This capability was originally intended solely for the &#34;push-to-create&#34; feature (automatically creating a repo on first push). However, the options are processed without restriction on already-existing repositories, and — critically — the visibility change bypasses every control that a proper settings change would trigger:</p> <p>- No entry written to the repository&#39;s audit/activity log - No webhook event fired (`repository` event with `visibility_changed` action) - No org-level notification to owners - No team permission re-calculation - No email alert to watchers - The database update uses `UpdateRepositoryColsNoAutoTime`, which also suppresses the `updated_at` timestamp change</p> <p>---</p> <p>#### Vulnerable Code</p> <p>**`routers/priv…</p> https://vulnerability.circl.lu/vuln/ghsa-8p9h-49rc-qgxj