CVE-2020-13246: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Gitea through version 1.11.5 (CVE-2020-13246), disclosed on May 20, 2020. The vulnerability allows an attacker to trigger a deadlock condition in the system by initiating a transfer of a repository's ownership from one organization to another (MITRE CVE, NVD).

The vulnerability occurs during the repository ownership transfer process between organizations. When attempting to transfer repository ownership, the system can enter a deadlock state that requires manual server restart to resolve. The issue has been assigned a CVSS v3.1 score of 7.2 (HIGH) and CVSS v2.0 score of 6.5 (MEDIUM), indicating significant severity (NVD).

When exploited, this vulnerability causes the Gitea server to freeze, requiring a manual restart to restore functionality. The deadlock effectively creates a denial of service condition, preventing users from accessing and managing repositories during the affected period (GitHub Issue).

The vulnerability can be triggered by any user with sufficient permissions to initiate repository ownership transfers between organizations. The exploit is relatively straightforward to execute, requiring only normal repository management actions within the Gitea interface (GitHub Issue).

The issue was fixed in subsequent releases through a pull request that modified the way organization team information is retrieved using sessions. Users are advised to upgrade to a patched version of Gitea. The fix was implemented in PR #11438 which addresses the deadlock condition (GitHub PR).