Closed
Description
Description
Technically you can't see the repositories of other users but you can see the name of that repository and know that it exists.
You have to use another account and the tool 'git clone' with the URL of the repository. You can see that the private repository exists because of the response.
Maybe this could lead to something else, in a CTF, I had to know the repository's name of the other user to make my user part of that repo by injecting a XSS and then, I could grab his SSH key to log into the machine.
The machine was Extension from HackTheBox.
Gitea Version
1.20.0
Can you reproduce the bug on the Gitea demo site?
Yes
Log Gist
No response
Screenshots
Git Version
2.39.2
Operating System
No response
How are you running Gitea?
I runned it from https://try.gitea.io/
Database
None