CVE-2022-38183
Gitea allowed assignment of private issues
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
- Record
CVE-2022-38183- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
- Record
CVE-2022-38183- Updated
- 2026-11-02
EUVDEUVD-2022-6551 No score
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
- Record
EUVD-2022-6551- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fhv8-m4j4-cww2
Gitea allowed assignment of private issues
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
- Record
GHSA-fhv8-m4j4-cww2- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVGHSA-fhv8-m4j4-cww2
Gitea allowed assignment of private issues
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
- Record
GHSA-fhv8-m4j4-cww2- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-38183
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
- Record
UBUNTU-CVE-2022-38183- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-gitea-2022-38183 No score
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
- Record
BIT-gitea-2022-38183- Updated
- 2026-11-02
OSV No score
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
- Record
CVE-2022-38183- Updated
- 2026-11-02
OSVGO-2024-2769 No score
Gitea allowed assignment of private issues in code.gitea.io/gitea
Gitea allowed assignment of private issues in code.gitea.io/gitea
- Record
GO-2024-2769- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
code.gitea.io/giteaGo |
before 1.16.9 | 1.16.9 |
giteaBitnami |
before 1.16.9 | 1.16.9 |
golang-code.gitea-gitUbuntu:18.04:LTS |
All versions, plus listed versions 0.0~git20170710.0.fc63966-10.0~git20170919.0.cdb43f0-10.0~git20171222.4ec3654-10.0~git20171222.4ec3654-3 |
None known |
golang-code.gitea-sdkUbuntu:18.04:LTS |
All versions, plus listed versions 0.0~git20170708.0.9990008-10.0~git20170920.0.60c6048-10.0~git20171220.79eee8f-10.0~git20171220.79eee8f-3 |
None known |
golang-code.gitea-gitUbuntu:20.04:LTS |
All versions, plus listed versions 0.0~git20171222.4ec3654-3 |
None known |
golang-code.gitea-sdkUbuntu:20.04:LTS |
All versions, plus listed versions 0.0~git20171220.79eee8f-3 |
None known |
golang-code.gitea-gitUbuntu:22.04:LTS |
All versions, plus listed versions 0.0~git20190411.63b74d4+ds-1 |
None known |
golang-code.gitea-sdkUbuntu:22.04:LTS |
All versions, plus listed versions 0.0~git20171220.79eee8f-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-38183 is a medium vulnerability (CVSS 6.5) in Gitea, published August 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in code.gitea.io/gitea 1.16.9.