GHSA-vmrc-8q2x-573x: Gitea issue changes on archived repositories through the API
The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository is archived. A user allowed to change issues of an archived repository could use the API to edit, close or delete issues, change labels and deadlines, add or delete tracked time and stopwatches, add reactions, change issue blocks, and pin issues, altering data that archiving is meant to freeze. Gitea 28.2.0 added the check to the issue edit, delete and label routes; Gitea 28.3.0 applies it to all modifying repository API requests.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who is already allowed to change issues in an archived repository can exploit it through affected REST API routes. The issue does not grant issue-management permissions to unauthorized users.
Are archived repositories protected by default in affected releases?
The web interface blocks issue and pull request changes on archived repositories, but affected REST API routes did not consistently enforce the archived-state check. As a result, API-capable users with issue modification permissions could still alter archived-repository issue data.
Which updates address the affected API routes?
Gitea 28.2.0 added archived-repository checks to the issue edit, delete, and label routes. Gitea 28.3.0 applies the check to all modifying repository API requests.
What can be changed through the affected API behavior?
Permitted users could edit, close, or delete issues; change labels and deadlines; add or delete tracked time and stopwatches; add reactions; change issue blocks; and pin issues. These actions can alter data that archiving is intended to freeze.