GHSA-f5fj-7265-jxhj
Gitea Exposes Private Email Addresses
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/go-gitea/gitea | < 1.5.1 | 1.5.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1.
### Specific Go Packages Affected
github.com/go-gitea/gitea/models
References
External links from the advisory. They lead to third-party sites.