Crossfyre
Disclosures
Vulnerabilities we found in other people's software and reported to the people who maintain it.
- Advisories filed
- 25
- covering 26 findings, 2 since closed
- Published by the maintainer
- 4
- listed in full below
- Still with the maintainer
- 19
- 3 fixed and under embargo
2 of these carry a CVE, both in Gitea: CVE-2026-104626 and CVE-2026-104633. It took 25 filings to get the first, and it arrived under a different advisory id than the one we filed under, after that one was closed without a fix. The other 2 published advisories went out with no identifier at all, so the databases that scanners read do not list them. Three more have one requested by the maintainer, which is not the same thing as assigned.
Published
Reports the maintainer has fixed and disclosed. The link is the record; ours is only the summary.
4 disclosures
- Gitea Moderate, 6.5
The migration downloader takes its page size from the migration source and uses it as the terminator for six paginated loops, so a source answering zero makes none of them ever break. One authenticated request drove a clean instance from 99MiB to 5.7GB of memory in ninety seconds, still climbing, while pulling roughly 7,700 requests a second from the attacker’s own host.
- Gitea Critical, 9.0
The fork-PR approval gate is enforced when a run is created and nowhere else. An attacker cancels their own pending run using a concurrency group they declare themselves, and a maintainer clicking Re-run dispatches the fork’s workflow to the runners as root, with the run still recording that it was never approved.
- OpenProject Medium, 4.3
A cache shared between viewers serves the first reader’s permissions to everyone after them, so the meeting agenda API returns the subjects of work packages the caller cannot open.
- SiYuan Moderate, 6.5
One GET to the dynamic icon endpoint expands an uncapped template function map until the kernel process is killed for exhausting memory. Reachable by any publish reader, and by anyone at all on a default publish service.
Why the rest is a number
A report gets its own entry here once the maintainer has published it, and not before. Naming a project next to an unfixed authorization bug tells an attacker which product to look at and roughly where to look, which defeats the purpose of having reported it quietly. Three of the open ones are additionally under an embargo the maintainer asked for, so they are not broken out by date or severity either: a fix date and a severity are enough to narrow a search.
That also rules out the obvious compromise, a list of the projects with nothing tying any of them to a particular finding. Eleven names under a heading that says we found authorization bugs in them is the same disclosure with an extra step, and two of these went through a bounty platform whose programs forbid disclosure without written permission. The counts move as maintainers work through them, and each row appears in full the day its advisory goes public.
Looking for the other direction, reporting something in Crossfyre itself? That is our security policy. Bugs we found in our own product are written up under publications, once they were fixed.