Gitea Repository Ownership Validation Vulnerability in Git LFS Lock Deletion

A vulnerability exists in Gitea's handling of Git Large File Storage (LFS) locks, specifically regarding the validation of repository ownership during the deletion process. Users with write access to a repository may inadvertently or intentionally delete LFS locks from other repositories, leading to potential disruption in version control and file management.

Impact

Exploitation of this vulnerability allows for improper deletion of LFS locks, which can disrupt the workflow and file management in repositories.

Reproduction

To reproduce this vulnerability, a user with write access to a repository can attempt to delete LFS locks. The lack of proper ownership validation may allow them to remove locks from other repositories, not just their own.

Remediation

Users can upgrade to Gitea version 1.25.4, where this vulnerability has been addressed.