CVE-2022-38183

MEDIUM

Gitea < 1.16.9 - Missing Authorization for Issue Assignment to Projects

Title source: llm

Description

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.

References (3)

Core 3

Core References

Release Notes, Vendor Advisory

https://blog.gitea.io/2022/07/gitea-1.16.9-is-released/

Broken Link

https://herolab.usd.de/security-advisories/usd-2022-0015/

Third Party Advisory vendor-advisory

https://security.gentoo.org/glsa/202210-14

Scores

CVSS v3 6.5

EPSS 0.0069

EPSS Percentile 48.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-862

Status published

Products (2)

code.gitea.io/gitea 0 - 1.16.9Go

gitea/gitea < 1.16.9

Published Aug 12, 2022

Tracked Since Feb 18, 2026