From 9267d8cec83742587881aa7f619a9f0343102821 Mon Sep 17 00:00:00 2001
From: Marshall Asch <marshallasch@gmail.com>
Date: Tue, 1 Sep 2026 17:48:48 -0400
Subject: [PATCH] gitea/forgejo: restrict access to internal API

The internal API is only ever called by the app itself over loopback
(git hooks and `gitea serv`), so it has no legitimate caller through the
reverse proxy. Leaving it reachable allowed CVE-2026-59774 to escalate
an unauthenticated org-mode file read into RCE: read app.ini, extract
INTERNAL_TOKEN, then inject a git hook via
/api/internal/manager/add-logger and trigger it on an anonymous clone.

^~ is required so the deny takes precedence over the existing regex
location that matches /api.

Forgejo is included as it shares the same internal API.

https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r
---
 forgejo.subdomain.conf.sample | 7 ++++++-
 forgejo.subfolder.conf.sample | 7 ++++++-
 gitea.subdomain.conf.sample   | 7 ++++++-
 gitea.subfolder.conf.sample   | 7 ++++++-
 4 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/forgejo.subdomain.conf.sample b/forgejo.subdomain.conf.sample
index e4012110d..30da3002d 100644
--- a/forgejo.subdomain.conf.sample
+++ b/forgejo.subdomain.conf.sample
@@ -1,4 +1,4 @@
-## Version 2025/07/18
+## Version 2026/09/01
 # make sure that your forgejo container is named forgejo
 # make sure that your dns has a cname set for forgejo
 # edit the following parameters in /data/forgejo/conf/app.ini or set as ENV vars in your container
@@ -57,6 +57,11 @@ server {
 
     }
 
+    # Restrict access to the internal API
+    location ^~ /api/internal {
+        deny all;
+    }
+
     location ~ (/forgejo)?/info/lfs {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
diff --git a/forgejo.subfolder.conf.sample b/forgejo.subfolder.conf.sample
index d23b33770..47ecc546d 100644
--- a/forgejo.subfolder.conf.sample
+++ b/forgejo.subfolder.conf.sample
@@ -1,4 +1,4 @@
-## Version 2024/04/20
+## Version 2026/09/01
 # make sure that your forgejo container is named forgejo
 # make sure that forgejo is set to work with the base url /forgejo/
 # The following parameters in /data/forgejo/conf/app.ini should be edited to match your setup
@@ -12,6 +12,11 @@ location /forgejo {
     return 301 $scheme://$host/forgejo/;
 }
 
+# Restrict access to the internal API
+location ^~ /forgejo/api/internal {
+    deny all;
+}
+
 location ^~ /forgejo/ {
     include /config/nginx/proxy.conf;
     include /config/nginx/resolver.conf;
diff --git a/gitea.subdomain.conf.sample b/gitea.subdomain.conf.sample
index af64dcb26..373f15a67 100644
--- a/gitea.subdomain.conf.sample
+++ b/gitea.subdomain.conf.sample
@@ -1,4 +1,4 @@
-## Version 2026/07/03
+## Version 2026/09/01
 # make sure that your gitea container is named gitea
 # make sure that your dns has a cname set for gitea
 # edit the following parameters in /data/gitea/conf/app.ini
@@ -69,6 +69,11 @@ server {
 
     }
 
+    # Restrict access to the internal API
+    location ^~ /api/internal {
+        deny all;
+    }
+
     location ~ (/gitea)?/(api|info/lfs) {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
diff --git a/gitea.subfolder.conf.sample b/gitea.subfolder.conf.sample
index 14f84a7fb..7b764ff16 100644
--- a/gitea.subfolder.conf.sample
+++ b/gitea.subfolder.conf.sample
@@ -1,4 +1,4 @@
-## Version 2023/02/05
+## Version 2026/09/01
 # make sure that your gitea container is named gitea
 # make sure that gitea is set to work with the base url /gitea/
 # The following parameters in /data/gitea/conf/app.ini should be edited to match your setup
@@ -11,6 +11,11 @@ location /gitea {
     return 301 $scheme://$host/gitea/;
 }
 
+# Restrict access to the internal API
+location ^~ /gitea/api/internal {
+    deny all;
+}
+
 location ^~ /gitea/ {
     include /config/nginx/proxy.conf;
     include /config/nginx/resolver.conf;