Executive brief
Gitea, a popular self-hosted Git service, contains a security flaw that allows users to bypass permission checks when forking repositories. An attacker with basic account access could fork a repository into an organization they do not have permission to manage. This could lead to the exposure of sensitive organization secrets and unauthorized access to internal project data.
Technical details
An improper access control vulnerability (CWE-284) exists in the Gitea API's repository fork flow. The application fails to validate the 'CanCreateOrgRepo' permission before allowing a user to fork a repository into a target organization. A remote attacker with low-privileged authenticated access can exploit this by sending a crafted API request to fork a repository into an organization where they lack repository creation rights. This bypass can be used to exfiltrate organization-level secrets or sensitive data. The issue is fixed in Gitea version 1.26.0 by enforcing the permission check in the API fork endpoint.
Affected products
- Gitea Gitea Open Source Git Server < 1.26.0
Timeline
- 2026-03-23: other: Pull request to fix the bug submitted
- 2026-04-18: patched: Gitea version 1.26.0 released
- 2026-07-03: advisory: CVE-2026-22555 published