Skip to content
Heist/ feed
Back to feed
Unrated

Security advisory

Type: advisorySources: OSVCVE: CVE-2022-38183

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2022-38183
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 15:29 UTC · Revision 1

Source evidence

CVE-2022-38183

core-osv · Original source

Published 12 Aug 2022, 00:00 UTC

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.

osv:CVE-2022-38183
Complete source record
{
  "id": "922ee8ec92baaad3a9996f0fca7cd4f0a74a77ca4f4338ebe99274c6d03f054d",
  "url": "https://osv.dev/vulnerability/CVE-2022-38183",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2022-38183",
    "summary": "In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.",
    "evidence": "osv:CVE-2022-38183",
    "products": [],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2022-38183",
      "aliases": [
        "BIT-gitea-2022-38183",
        "CVE-2022-38183",
        "GHSA-fhv8-m4j4-cww2",
        "GO-2024-2769"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/go-gitea/gitea",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "713bc6c8dca072c3946e5ff1ab6b1c58748f1a1a"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.16.9"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.16.8",
            "v1.16.7",
            "v1.16.6",
            "v1.16.5",
            "v1.16.4",
            "v1.16.3",
            "v1.16.2",
            "v1.16.1",
            "v1.16.0",
            "v1.16.0-rc1",
            "v1.15.0-rc1",
            "v1.16.0-dev",
            "v1.15.0-dev",
            "v1.14.0-dev",
            "v1.13.0-dev",
            "v1.12.0-dev",
            "v1.10.5",
            "v1.11.0-rc1",
            "v1.10.0-rc1",
            "v1.11.0-dev",
            "v1.9.0-rc1",
            "v1.10.0-dev",
            "v1.9.0-dev",
            "v1.7.0-dev",
            "v1.6.0-rc1",
            "v1.6.0-dev",
            "v1.5.0-rc1",
            "v1.5.0-dev",
            "v1.1.0",
            "v1.0.0",
            "v0.9.99"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38183.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:29.902997966Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38183.json",
        "https://herolab.usd.de/security-advisories/usd-2022-0015/",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-38183",
        "https://security.gentoo.org/glsa/202210-14",
        "https://blog.gitea.io/2022/07/gitea-1.16.9-is-released/"
      ],
      "provider_metadata": {
        "cna_assigner": "mitre",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38183.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-38183",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 496833,
  "published_at": "2022-08-12T00:00:00+00:00"
}