Potential Security Incident: Unknown Users Found #8028
Description
I've noticed strange activity in the logs and the presence of new user accounts that I did not create.
xorm.log
2025/07/28 16:53:46 gogs.io/gogs/internal/database/repositories.go:350 SLOW SQL >= 100ms
[110.289ms] [rows:1] UPDATE `repository` SET `is_bare`=false,`updated_unix`=1753721626 WHERE id = 40
2025/07/28 16:53:46 gogs.io/gogs/internal/database/users.go:723 record not found
[0.351ms] [rows:0] SELECT `user`.`id`,`user`.`lower_name`,`user`.`name`,`user`.`full_name`,`user`.`email`,`user`.`passwd`,`user`.`login_source`,`user`.`login_name`,`user`.`type`,`user`.`location`,`user`.`website`,`user`.`rands`,`user`.`salt`,`user`.`created_unix`,`user`.`updated_unix`,`user`.`last_repo_visibility`,`user`.`max_repo_creation`,`user`.`is_active`,`user`.`is_admin`,`user`.`allow_git_hook`,`user`.`allow_import_local`,`user`.`prohibit_login`,`user`.`avatar`,`user`.`avatar_email`,`user`.`use_custom_avatar`,`user`.`num_followers`,`user`.`num_following`,`user`.`num_stars`,`user`.`num_repos`,`user`.`description`,`user`.`num_teams`,`user`.`num_members` FROM `user` LEFT JOIN email_address ON email_address.uid = user.id WHERE user.type = 0 AND ((user.email = "gx6czwhl@exploit.local" AND user.is_active = true) OR (email_address.email = "gx6czwhl@exploit.local" AND email_address.is_activated = true)) ORDER BY `user`.`id` LIMIT 1
2025/07/28 16:53:46 gogs.io/gogs/internal/database/users.go:723 record not found
[0.380ms] [rows:0] SELECT `user`.`id`,`user`.`lower_name`,`user`.`name`,`user`.`full_name`,`user`.`email`,`user`.`passwd`,`user`.`login_source`,`user`.`login_name`,`user`.`type`,`user`.`location`,`user`.`website`,`user`.`rands`,`user`.`salt`,`user`.`created_unix`,`user`.`updated_unix`,`user`.`last_repo_visibility`,`user`.`max_repo_creation`,`user`.`is_active`,`user`.`is_admin`,`user`.`allow_git_hook`,`user`.`allow_import_local`,`user`.`prohibit_login`,`user`.`avatar`,`user`.`avatar_email`,`user`.`use_custom_avatar`,`user`.`num_followers`,`user`.`num_following`,`user`.`num_stars`,`user`.`num_repos`,`user`.`description`,`user`.`num_teams`,`user`.`num_members` FROM `user` LEFT JOIN email_address ON email_address.uid = user.id WHERE user.type = 0 AND ((user.email = "gogs@fake.local" AND user.is_active = true) OR (email_address.email = "gogs@fake.local" AND email_address.is_activated = true)) ORDER BY `user`.`id` LIMIT 1
2025/07/28 16:53:46 gogs.io/gogs/internal/database/actions.go:150 SLOW SQL >= 100ms
[122.007ms] [rows:1] INSERT INTO `action` (`user_id`,`op_type`,`act_user_id`,`act_user_name`,`repo_id`,`repo_user_name`,`repo_name`,`ref_name`,`is_private`,`content`,`created_unix`) VALUES (8,5,8,"GX6CZWhl",40,"GX6CZWhl","a0Dx2aSe","master",false,"{""Len"":2,""Commits"":[{""Sha1"":""6b1dc699d4272ad86e75ddb8d30e7d8269eea41f"",""Message"":""Add symlink to .git/config\n"",""AuthorEmail"":""GX6CZWhl@exploit.local"",""AuthorName"":""GX6CZWhl"",""CommitterEmail"":""GX6CZWhl@exploit.local"",""CommitterName"":""GX6CZWhl"",""Timestamp"":""2025-07-28T16:53:44Z""},{""Sha1"":""28c94442ab38ebb7350a0a548aa96230dcc3df27"",""Message"":""Initial commit\n"",""AuthorEmail"":""gx6czwhl@sadasej.com"",""AuthorName"":""GX6CZWhl"",""CommitterEmail"":""gogs@fake.local"",""CommitterName"":""Gogs"",""Timestamp"":""2025-07-28T16:53:43Z""}],""CompareURL"":""GX6CZWhl/a0Dx2aSe/compare/28c94442ab38ebb7350a0a548aa96230dcc3df27...6b1dc699d4272ad86e75ddb8d30e7d8269eea41f""}",1753721626) RETURNING `id`
2025/07/28 16:53:51 gogs.io/gogs/internal/database/repositories.go:350 SLOW SQL >= 100ms
[164.167ms] [rows:1] UPDATE `repository` SET `is_bare`=false,`updated_unix`=1753721631 WHERE id = 41
2025/07/28 16:53:51 gogs.io/gogs/internal/database/users.go:723 record not found
[0.386ms] [rows:0] SELECT `user`.`id`,`user`.`lower_name`,`user`.`name`,`user`.`full_name`,`user`.`email`,`user`.`passwd`,`user`.`login_source`,`user`.`login_name`,`user`.`type`,`user`.`location`,`user`.`website`,`user`.`rands`,`user`.`salt`,`user`.`created_unix`,`user`.`updated_unix`,`user`.`last_repo_visibility`,`user`.`max_repo_creation`,`user`.`is_active`,`user`.`is_admin`,`user`.`allow_git_hook`,`user`.`allow_import_local`,`user`.`prohibit_login`,`user`.`avatar`,`user`.`avatar_email`,`user`.`use_custom_avatar`,`user`.`num_followers`,`user`.`num_following`,`user`.`num_stars`,`user`.`num_repos`,`user`.`description`,`user`.`num_teams`,`user`.`num_members` FROM `user` LEFT JOIN email_address ON email_address.uid = user.id WHERE user.type = 0 AND ((user.email = "gogs@fake.local" AND user.is_active = true) OR (email_address.email = "gogs@fake.local" AND email_address.is_activated = true)) ORDER BY `user`.`id` LIMIT 1
2025/07/28 16:53:51 gogs.io/gogs/internal/database/users.go:723 record not found
[0.249ms] [rows:0] SELECT `user`.`id`,`user`.`lower_name`,`user`.`name`,`user`.`full_name`,`user`.`email`,`user`.`passwd`,`user`.`login_source`,`user`.`login_name`,`user`.`type`,`user`.`location`,`user`.`website`,`user`.`rands`,`user`.`salt`,`user`.`created_unix`,`user`.`updated_unix`,`user`.`last_repo_visibility`,`user`.`max_repo_creation`,`user`.`is_active`,`user`.`is_admin`,`user`.`allow_git_hook`,`user`.`allow_import_local`,`user`.`prohibit_login`,`user`.`avatar`,`user`.`avatar_email`,`user`.`use_custom_avatar`,`user`.`num_followers`,`user`.`num_following`,`user`.`num_stars`,`user`.`num_repos`,`user`.`description`,`user`.`num_teams`,`user`.`num_members` FROM `user` LEFT JOIN email_address ON email_address.uid = user.id WHERE user.type = 0 AND ((user.email = "9bsmilmt@exploit.local" AND user.is_active = true) OR (email_address.email = "9bsmilmt@exploit.local" AND email_address.is_activated = true)) ORDER BY `user`.`id` LIMIT 1
2025/07/28 16:53:51 gogs.io/gogs/internal/database/actions.go:150 SLOW SQL >= 100ms
[134.121ms] [rows:1] INSERT INTO `action` (`user_id`,`op_type`,`act_user_id`,`act_user_name`,`repo_id`,`repo_user_name`,`repo_name`,`ref_name`,`is_private`,`content`,`created_unix`) VALUES (9,5,9,"9bSMiLmT",41,"9bSMiLmT","BlvqfGgU","master",false,"{""Len"":2,""Commits"":[{""Sha1"":""6958375e1afdb2ac0a293a8aa0fad6a2a1d37193"",""Message"":""Initial commit\n"",""AuthorEmail"":""9bsmilmt@sadasej.com"",""AuthorName"":""9bSMiLmT"",""CommitterEmail"":""gogs@fake.local"",""CommitterName"":""Gogs"",""Timestamp"":""2025-07-28T16:53:47Z""},{""Sha1"":""63360fcddc469c54349dcfab5c1ea3224bc22c38"",""Message"":""Add symlink to .git/config\n"",""AuthorEmail"":""9bSMiLmT@exploit.local"",""AuthorName"":""9bSMiLmT"",""CommitterEmail"":""9bSMiLmT@exploit.local"",""CommitterName"":""9bSMiLmT"",""Timestamp"":""2025-07-28T16:53:47Z""}],""CompareURL"":""9bSMiLmT/BlvqfGgU/compare/6958375e1afdb2ac0a293a8aa0fad6a2a1d37193...63360fcddc469c54349dcfab5c1ea3224bc22c38""}",1753721631) RETURNING `id`
2025/07/28 16:56:38 gogs.io/gogs/internal/database/users.go:723 record not found
[0.858ms] [rows:0] SELECT `user`.`id`,`user`.`lower_name`,`user`.`name`,`user`.`full_name`,`user`.`email`,`user`.`passwd`,`user`.`login_source`,`user`.`login_name`,`user`.`type`,`user`.`location`,`user`.`website`,`user`.`rands`,`user`.`salt`,`user`.`created_unix`,`user`.`updated_unix`,`user`.`last_repo_visibility`,`user`.`max_repo_creation`,`user`.`is_active`,`user`.`is_admin`,`user`.`allow_git_hook`,`user`.`allow_import_local`,`user`.`prohibit_login`,`user`.`avatar`,`user`.`avatar_email`,`user`.`use_custom_avatar`,`user`.`num_followers`,`user`.`num_following`,`user`.`num_stars`,`user`.`num_repos`,`user`.`description`,`user`.`num_teams`,`user`.`num_members` FROM `user` LEFT JOIN email_address ON email_address.uid = user.id WHERE user.type = 0 AND ((user.email = "g8twmqhq@exploit.local" AND user.is_active = true) OR (email_address.email = "g8twmqhq@exploit.local" AND email_address.is_activated = true)) ORDER BY `user`.`id` LIMIT 1
2025/07/28 16:56:38 gogs.io/gogs/internal/database/users.go:723 record not found
[0.240ms] [rows:0] SELECT `user`.`id`,`user`.`lower_name`,`user`.`name`,`user`.`full_name`,`user`.`email`,`user`.`passwd`,`user`.`login_source`,`user`.`login_name`,`user`.`type`,`user`.`location`,`user`.`website`,`user`.`rands`,`user`.`salt`,`user`.`created_unix`,`user`.`updated_unix`,`user`.`last_repo_visibility`,`user`.`max_repo_creation`,`user`.`is_active`,`user`.`is_admin`,`user`.`allow_git_hook`,`user`.`allow_import_local`,`user`.`prohibit_login`,`user`.`avatar`,`user`.`avatar_email`,`user`.`use_custom_avatar`,`user`.`num_followers`,`user`.`num_following`,`user`.`num_stars`,`user`.`num_repos`,`user`.`description`,`user`.`num_teams`,`user`.`num_members` FROM `user` LEFT JOIN email_address ON email_address.uid = user.id WHERE user.type = 0 AND ((user.email = "gogs@fake.local" AND user.is_active = true) OR (email_address.email = "gogs@fake.local" AND email_address.is_activated = true)) ORDER BY `user`.`id` LIMIT 1
2025/07/28 16:56:38 gogs.io/gogs/internal/database/actions.go:150 SLOW SQL >= 100ms
[147.702ms] [rows:1] INSERT INTO `action` (`user_id`,`op_type`,`act_user_id`,`act_user_name`,`repo_id`,`repo_user_name`,`repo_name`,`ref_name`,`is_private`,`content`,`created_unix`) VALUES (10,5,10,"g8twMQHq",42,"g8twMQHq","
5DBA
PvK31eXh","master",false,"{""Len"":2,""Commits"":[{""Sha1"":""5fa953740ef861316bd57fcbea3d08e875ffa7ec"",""Message"":""Add symlink to .git/config\n"",""AuthorEmail"":""g8twMQHq@exploit.local"",""AuthorName"":""g8twMQHq"",""CommitterEmail"":""g8twMQHq@exploit.local"",""CommitterName"":""g8twMQHq"",""Timestamp"":""2025-07-28T16:56:36Z""},{""Sha1"":""2926e9e9f2c2577b1a8cdb862e00afc980fe6377"",""Message"":""Initial commit\n"",""AuthorEmail"":""g8twmqhq@sadasej.com"",""AuthorName"":""g8twMQHq"",""CommitterEmail"":""gogs@fake.local"",""CommitterName"":""Gogs"",""Timestamp"":""2025-07-28T16:56:35Z""}],""CompareURL"":""g8twMQHq/PvK31eXh/compare/2926e9e9f2c2577b1a8cdb862e00afc980fe6377...5fa953740ef861316bd57fcbea3d08e875ffa7ec""}",1753721798) RETURNING `id`