Information Disclosure Vulnerability in Gitea

A security vulnerability exists in Gitea versions prior to 1.22.6, which permits a remote, unauthenticated attacker to perform information disclosure. This flaw enables unauthorized access to repository data or internal system information that should otherwise be restricted. Defenders should prioritize patching to Gitea version 1.22.6 or later to mitigate the risk of data leakage.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to access sensitive internal data, potentially leading to the exposure of proprietary source code, credentials, or metadata stored within the Gitea instance. The scope of impact affects any organization hosting Gitea instances vulnerable to this specific information disclosure flaw.

Recommendation

• Patch Gitea to version 1.22.6 or later immediately.
• Audit access logs for unusual patterns of unauthenticated requests targeting repository metadata or configuration endpoints.