Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Affected: Go: code.gitea.io/gitea

**Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @ `b7e95cc48c` (development build, go1.26.3) **Component:** `routers/api/v1/org/action.go` (org-level Actions API) **OWASP:** API3:2023 Broken Object Property Level Authorization

---

## 1. Summary

The org-level Actions REST endpoints

``` GET /api/v1/orgs/{org}/actions/runs GET /api/v1/orgs/{org}/actions/jobs ```

are gated only by **`reqOrgMembership()`** + `reqToken()`. They then call `shared.ListRuns(ctx, ctx.Org.Organization.ID, 0)` / `shared.ListJobs(ctx, ctx.Org.Organization.ID, 0, 0, nil)`, which selects **every** `action_run` / `action_run_job` row whose repository belongs to the org — with **no per-repository ACL check**.

Result: any user who is a member of an organization can enumerate workflow runs and jobs from **every repository in that org**, including:

* private repositories the caller has no team membership for, * repositories where the caller has been explicitly denied the `repo.actions` unit, * repositories created by other teams the caller is not part of.

Direct per-repo equivalents (`GET /api/v1/repos/{owner}/{repo}/actions/runs`, `…/jobs/{job_id}/logs`, `…/runs/{run_id}/jobs`) correctly return `404` for the same caller — proving the org-level surface is the only path that leaks.

---

## 2. Affected Code

### 2.1 Route registration

`routers/api/v1/api.go:1647-1652`

```go addActionsRoutes( m, reqOrgMembership(), // reqR…