A critical IDOR vulnerability in Gitea Open Source Git Server enables unauthorized repository interaction, posing a significant risk to source code integrity and confidentiality.

This vulnerability is an Insecure Direct Object Reference (CWE-862) occurring within the issue-dependency removal function. The flaw allows unauthenticated remote attackers to bypass access controls and interact with private repositories, including modifying dependencies and adding comments.

The ability for an unauthenticated attacker to manipulate private repositories can lead to severe intellectual property theft, unauthorized disclosure of sensitive project data, and the potential for malicious code injection into internal development workflows. With a CVSS score of 7.5, this vulnerability represents a high-severity risk that could compromise the entire software development lifecycle of an organization.

Immediate Action: Update Gitea Open Source Git Server to version 1.27.0 or later to include the necessary access control fixes.

Proactive Monitoring: Review repository access logs for unusual activity originating from unknown or unauthorized users, specifically focusing on dependency modification events.

Compensating Controls: Implement strict network-level access controls to limit exposure of the Gitea instance to trusted internal networks or VPNs until patching is completed.

Public Exploit Available: Unknown

Given the potential for unauthorized access to private source code and the availability of a proof-of-concept, administrators should prioritize this update immediately. Organizations relying on Gitea for version control must verify their current version and apply the 1.27.0 patch to prevent unauthorized repository tampering.