Fix Gitea API unauthenticated access and upgrade to 1.26.0#1597
Open
LukasCuperDT wants to merge 3 commits into
Open
Fix Gitea API unauthenticated access and upgrade to 1.26.0#1597LukasCuperDT wants to merge 3 commits into
LukasCuperDT wants to merge 3 commits into
Conversation
- Enable [api] section header (was commented out as ;[api]) - Set REQUIRE_SIGNIN_VIEW = true in [api] section to prevent unauthenticated API access to private repository data - Upgrade Gitea from 1.24.0 to 1.26.0 with updated checksum Security: GET /api/v1/repos/issues/search was returning private org data (employee names, private repo names) without authentication.
LukasCuperDT
requested review from
SebastianGode,
otcbot,
sgmv,
tischrei and
vladimirhasko
as code owners
SebastianGode
previously approved these changes
Apr 24, 2026
The [api] REQUIRE_SIGNIN_VIEW is not effective in Gitea 1.24.0. Setting it in [service] section forces authentication for all access including the vulnerable /api/v1/repos/issues/search endpoint.
SebastianGode
previously approved these changes
Apr 24, 2026
Revert gitea_version back to 1.24.0 - version upgrade should be done in a separate PR after proper testing.
LukasCuperDT
force-pushed
the
fix/gitea-api-require-auth
branch
from
e4ec2cb to
b895f9d
Compare
SebastianGode
approved these changes
Apr 24, 2026
tischrei
approved these changes
Apr 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix
Vulnerability:
GET /api/v1/repos/issues/searchreturns private organization data (employee names, private repo names, issue details) without authentication.Impact: HIGH — PII exposure, private repo enumeration (88+ repos), OTC service infrastructure mapping visible to unauthenticated users.
Changes
[api]section inapp.ini.j2(was commented out as;[api], so settings were falling under[mailer])REQUIRE_SIGNIN_VIEW = truein[api]section to require authentication for all API endpointsFiles Changed
playbooks/roles/gitea/templates/app.ini.j2— uncomment[api]header, setREQUIRE_SIGNIN_VIEW = trueinventory/service/group_vars/gitea.yaml— version 1.26.0 + new checksumplaybooks/roles/gitea/defaults/main.yaml— version 1.26.0 + new checksumTesting
After merge and Ansible deployment, verify: