Executive brief
Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea
Affected products
- Go code.gitea.io/gitea
Junglewise Threat Intelligence
GO-2026-6074 - Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea
Severity: info · Published 2026-07-27
Technologies: code.gitea.io/gitea (Go). Vendors: Go.
Related threats
- Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- GO-2026-6039 - Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata in gitea.dev
- Gitea public-only token scope bypass in Organization and Permission endpoints
- Gitea SSRF and local file read via migration asset bypass
- Gitea plaintext webhook authorization header exposure in API