CVE-2022-38183: In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to…

PriorityP337medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EPSS

0.69%

48.1th percentile

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
code.gitea.io	gitea	>= 0 < 1.16.9	1.16.9
gitea	gitea	< 1.16.9	1.16.9

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

osv6.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.