What’s Vulnerable › Vulnerabilities

CVE-2022-38183

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-12 · updated 2026-06-17
• Weakness: CWE-862

Description

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.

Affected products

• Gitea Open Source Git Server: before 1.16.9 — fixed in 1.16.9

How to fix

Upgrade to a fixed version: Gitea Open Source Git Server 1.16.9. Check the vendor advisory for mitigations.

References

• https://blog.gitea.io/2022/07/gitea-1.16.9-is-released/
• https://herolab.usd.de/security-advisories/usd-2022-0015/
• https://security.gentoo.org/glsa/202210-14
• https://blog.gitea.io/2022/07/gitea-1.16.9-is-released/
• https://herolab.usd.de/security-advisories/usd-2022-0015/
• https://security.gentoo.org/glsa/202210-14

Get alerted when CVE-2022-38183 or the next vulnerability affects your stack