Gitblit's 20,398 title matches need team and federation review

Gitblit is a self-hosted Git server with a web interface, repository browsing, team-based permissions, LDAP integration, and a federation feature for copying repositories and account metadata between instances. It can be a compact internal service or a public code host. The security review changes with that role, but the central questions remain the same: who can read a repository, who can administer the server, and where do copies of the data go?

On 2026-11-09, ZoomEye count-only queries with sub_type="all", page 1, and page size 1 returned 20,398 matches for title="Gitblit" and 883,482 for app="Gitblit". The enormous difference between the two fields is a warning about scope. The title value is more specific to a visible Gitblit page, while the application field may be broad or include many assets that are not an exposed repository service. Do not use the larger number as a count of vulnerable servers. Treat both as observations that need ownership and service validation.

Gitblit's administration documentation describes six per-user or per-team repository permissions and computes a user's effective access from team memberships. A user can belong to several teams, and a repository can belong to multiple teams. The highest permission can win, which is convenient but can also expand access after a team is added to a repository. Review the team graph, the repository-to-team mapping, and the effective permission for a representative user. A repository that appears private to its owner may be readable through a team that nobody remembers adding.

LDAP integration adds a separate identity source. Gitblit can delegate authentication to LDAP and optionally maintain team membership from directory groups. If team maintenance is enabled, a directory group change can alter repository access without a local Gitblit administrator making the change. That is a useful automation, but it means the identity team and the code-host owner must share a change process. Test what happens when a user is removed from LDAP, disabled in the directory, or moved between teams. The local session and personal access state need a defined cleanup rule.

Gitblit federation is another data path. The federation documentation describes permission tokens shared with other Gitblit instances, serialized account and repository metadata, and normal authentication and authorization for federation requests. A federation token is not a backup password. It is a cross-instance authorization object. Inventory federation registrations, token lifetimes, allowed repositories, and the accounts that can create them. Test that a token cannot pull a repository outside its intended scope and that removal of a federation partner invalidates the old token.

The server's JSON RPC interface is powerful. The project description says administrators can manage repositories, users, and teams through the interface using Gitblit Manager or custom tooling. That deserves the same network restriction and authentication review as the web admin page. A token that can create users or change team membership can also change repository access. Do not expose the RPC endpoint to a public network merely because the UI is behind a proxy.

The practical review starts with the 20,398 title observations and resolves the owned hosts, then verifies the repository service rather than assuming every title is a server. Record the release, authentication realm, team-membership source, federation partners, and administrator accounts. Test anonymous clone, a read-only team, a writer, and an administrator. Compare the result across HTTPS and any SSH or Git protocol listener.

ZoomEye helps find a Gitblit interface that the asset inventory missed. The team and federation configuration explains what that interface controls. A large application-field count without those checks is just a number. A smaller set of verified hosts with a clean team graph and scoped federation tokens is the useful outcome.

References

• Gitblit: Authentication setup
• Gitblit: Administration
• Gitblit: Federation