Vulnerability: Information Exposure Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1.
Vulnerability ID: GHSA-f5fj-7265-jxhj
CWE: CWE-200
Severity score: 5.3
Project: https://github.com/go-gitea/gitea
Published: 2022-02-15
File: models/issue_mail.go
Commit message: Don't disclose emails of all users when sending out emails (#4664)
Commit author: techknowlogick

Vulnerable version (before fix):
 // Copyright 2016 The Gogs Authors. All rights reserved. // Use of this source code is governed by a MIT-style // license that can be found in the LICENSE file.  func mailIssueCommentToParticipants(e Engine, issue *Issue, doer *User, content 		names = append(names, participants[i].Name) 	}  	SendIssueCommentMail(issue, doer, content, comment, tos)  	// Mail mentioned people and exclude watchers. 	names = append(names, doer.Name) func mailIssueCommentToParticipants(e Engine, issue *Issue, doer *User, content  		tos = append(tos, mentions[i]) 	} 	SendIssueMentionMail(issue, doer, content, comment, getUserEmailsByNames(e, tos))  	return nil }

Fixed version (after fix):
 // Copyright 2016 The Gogs Authors. All rights reserved. // Copyright 2018 The Gitea Authors. All rights reserved. // Use of this source code is governed by a MIT-style // license that can be found in the LICENSE file.  func mailIssueCommentToParticipants(e Engine, issue *Issue, doer *User, content 		names = append(names, participants[i].Name) 	}  	for _, to := range tos { 		SendIssueCommentMail(issue, doer, content, comment, []string{to}) 	}  	// Mail mentioned people and exclude watchers. 	names = append(names, doer.Name) func mailIssueCommentToParticipants(e Engine, issue *Issue, doer *User, content  		tos = append(tos, mentions[i]) 	}  	emails := getUserEmailsByNames(e, tos)  	for _, to := range emails { 		SendIssueMentionMail(issue, doer, content, comment, []string{to}) 	}  	return nil }

Patch:
patch: @@ -1,4 +1,5 @@
 // Copyright 2016 The Gogs Authors. All rights reserved.
+// Copyright 2018 The Gitea Authors. All rights reserved.
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
 
@@ -87,7 +88,9 @@ func mailIssueCommentToParticipants(e Engine, issue *Issue, doer *User, content
 		names = append(names, participants[i].Name)
 	}
 
-	SendIssueCommentMail(issue, doer, content, comment, tos)
+	for _, to := range tos {
+		SendIssueCommentMail(issue, doer, content, comment, []string{to})
+	}
 
 	// Mail mentioned people and exclude watchers.
 	names = append(names, doer.Name)
@@ -99,7 +102,12 @@ func mailIssueCommentToParticipants(e Engine, issue *Issue, doer *User, content
 
 		tos = append(tos, mentions[i])
 	}
-	SendIssueMentionMail(issue, doer, content, comment, getUserEmailsByNames(e, tos))
+
+	emails := getUserEmailsByNames(e, tos)
+
+	for _, to := range emails {
+		SendIssueMentionMail(issue, doer, content, comment, []string{to})
+	}
 
 	return nil
 }
path: models/issue_mail.go