Gitea Token Scope Mismanagement Vulnerability in Package Registry Access Control

A vulnerability exists in Gitea versions prior to 1.22.2, where the application improperly manages the propagation of token scopes related to access control within certain package registries. This mismanagement can lead to unauthorized access or actions within the affected package registry.

Impact

Exploitation of this vulnerability could result in improper access control, allowing users to upload packages to registries without the necessary permissions.

Reproduction

The vulnerability can be reproduced by uploading a package to a registry that requires specific access permissions. If the upload is successful without the appropriate permissions, it demonstrates the mismanagement of token scopes.

Remediation

Users are advised to update to Gitea version 1.22.2, which addresses this vulnerability. Instructions for updating can be found in the Gitea installation guide.