Summary
Gitea protects state-changing web routes against cross-site requests in crossOriginProtection.Check (web.go:218-223). That check runs inside the sign-in middleware (verifyAuthWithOptionsWeb, through reqSignIn/optSignIn).
The repository-topics route is registered in a group with context.RepoAssignment, reqRepoAdmin but without any sign-in middleware. The cross-origin check therefore never runs, so a cross-site POST carrying the victim's session cookie is accepted. Sibling routes such as /action/star are correctly rejected with 403.
Details
the source location should be routers/web/web.go:1524-1526
Impact
- A malicious or compromised website can silently overwrite or clear the topics of any repository whose admin visits it while logged in to Gitea.
- This enables defacement, misleading search and discovery results (for example tagging a repo as "malware" or adding SEO spam), and wiping curated topic sets.
- The impact is limited to integrity of the topics field, with no data disclosure.
bruhdev1290 Reporter
bircni Remediation developer
silverwind Remediation developer
wxiaoguang Remediation developer
Summary
Gitea protects state-changing web routes against cross-site requests in
crossOriginProtection.Check(web.go:218-223). That check runs inside the sign-in middleware (verifyAuthWithOptionsWeb, throughreqSignIn/optSignIn).The repository-topics route is registered in a group with
context.RepoAssignment, reqRepoAdminbut without any sign-in middleware. The cross-origin check therefore never runs, so a cross-site POST carrying the victim's session cookie is accepted. Sibling routes such as/action/starare correctly rejected with 403.Details
the source location should be routers/web/web.go:1524-1526
Impact