Hoangperry

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** An authorization bypass exists in three API endpoints that allow users to read specific files from a private repository's default branch even if they lack the required Code unit permissions. The issue occurs because these endpoints are registered without the `reqRepoReader(unit.TypeCode)` authorization middleware used by other similar endpoints. Consequently, a user granted access to a repository through any other unit (such as the Issues unit) can access the contents of `.gitea/ISSUE TEMPLATE/*` and `issue config.yaml`. **API Endpoints:** - '/repos/{owner}/{repo}/issue templates' - '/repos/{owner}/{repo}/issue config' - '/repos/{owner}/{repo}/issue config/validate' **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.