CVE-2025-24890
gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs, gix_sec::identity::is_path_owned_by_current_user obtains folder_owner and token_owner, but its administrator-specific IsWellKnownSid and CheckTokenMembership checks examine the running token rather than confirming the directory owner. This bypasses safe.directory-style protection for repositories owned and configured by a limited user, allowing repository configuration or hooks to execute commands with the administrator's privileges when an affected operation is performed. Exploitation requires Windows, an elevated administrator, a program that relies on gix-sec trust results, and interaction with a repository controlled by another user. An unelevated UAC process is not affected, and cloning is not affected because repository configuration and hooks are not copied. This issue is fixed in version 0.13.3.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
- EPSS probability
- 0.15%
- CWE
- CWE-283
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- GitoxideLabs gitoxide
Weakness type
Related vulnerabilities
- CVE-2026-26016 — Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
- CVE-2026-29788 — TSPortal: Anyone can forge self-deletion requests of any user
- CVE-2025-43882 — Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability. A local low-privileged a
- CVE-2020-8554 — Kubernetes man in the middle using LoadBalancer or ExternalIPs
- CVE-2026-4269 — Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
- CVE-2025-47940 — TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer
- CVE-2025-1007 — Improper Authorization in /user/namespace/{namespace}/details
- CVE-2024-27903 — OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker