fix: org metadata API endpoints should respect org visibility for unauthenticated requests #690

New Issue

2026-06-21T23:14:31Z

jmiller commented

2026-06-21 23:14:31 +00:00

Summary

The /orgs/{org}/issue-statuses, /orgs/{org}/issue-priorities, and /orgs/{org}/issue-types endpoints are accessible without authentication. For public orgs this is fine, but private org metadata (custom statuses, priorities, types) can be enumerated by unauthenticated users.

Fix

Add a visibility check in each handler: if the org is not public and the caller is not authenticated or not a member, return 404.

Files

routers/api/v1/org/issue_metadata.go — add visibility check to ListIssueStatuses, ListIssuePriorities, ListIssueTypes

## Summary The `/orgs/{org}/issue-statuses`, `/orgs/{org}/issue-priorities`, and `/orgs/{org}/issue-types` endpoints are accessible without authentication. For public orgs this is fine, but private org metadata (custom statuses, priorities, types) can be enumerated by unauthenticated users. ## Fix Add a visibility check in each handler: if the org is not public and the caller is not authenticated or not a member, return 404. ## Files - `routers/api/v1/org/issue_metadata.go` — add visibility check to ListIssueStatuses, ListIssuePriorities, ListIssueTypes

jmiller referenced this issue from a commit

2026-06-21 23:17:04 +00:00

fix: org metadata API respects visibility for unauthenticated requests (#690)

jmiller closed this issue

2026-06-21 23:17:54 +00:00

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-Fork#690