spingARbor

Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check

Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)

Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

Notification API Leaks Private Repository Issue Titles After Collaborator Permission Revocation

Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure

Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)

Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes

Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation