CVE-2023-49946 Missing authorization in n/a

Critical 9.1 Published 3 Dec 2023 Updated 2 Aug 2024

Remote attackers can read private issues and pull requests or delete issues due to missing object ownership checks in Forgejo.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-49946?

CVE-2023-49946 is a critical missing authorization vulnerability in n/a, published on 3 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.

Weakness: CWE-732

Which versions are affected by CVE-2023-49946?

It affects 1 product.

Products include Forgejo Forgejo.

How do I fix CVE-2023-49946?

No fix has been published for CVE-2023-49946 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-49946 being exploited?

There is no known exploitation of CVE-2023-49946 in the wild and no public exploit code.

Sources

Also known as GHSA-fv68-mgcx-47jh.