概要
Self-hosted Git services hold source code and package metadata near high-trust developer workflows. When an affected Gitea version appears in deployment configuration, maintainers get a concrete upgrade signal without an intrusive authorization test.
仕組み
The advisory concerns permission checks around Composer package source links in Gitea releases through 1.26.1. A repository match establishes the pinned server image version only; deployment, Composer registry use, linked-repository visibility, caller access, and actual disclosure remain unverified.
被害範囲
Under the advisory conditions, a caller who can read a Composer package may receive source-location information for a linked repository they cannot otherwise access. That can reveal private or internal repository metadata, but a repo version match alone does not establish those runtime conditions.
// fixvibeのチェック内容
FixVibeのチェック内容
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
鉄壁の防御
Upgrade every active Gitea server deployment to 1.26.2 or newer, preferably the latest supported release, then rebuild or redeploy and verify the running version. Review Composer package visibility and linked-repository permissions through normal authorized administration after the upgrade.