Improper Authorization in Gitea - CVE-2026-22555

Detailed vulnerability description

The vulnerability allows a remote user to disclose sensitive information and push arbitrary code under the organization's namespace.

The vulnerability exists due to improper access control in the `POST /api/v1/repos/{owner}/{repo}/forks` API endpoint when forking a repository into an organization. A remote user can send a crafted API request to create a fork in the organization namespace, obtain admin permissions on that fork, and exfiltrate organization-level CI/CD secrets.

Exploitation requires membership in the target organization and access to an existing organization repository. Instances with Actions enabled and runner infrastructure available are affected by the secret exfiltration path.

How to mitigate CVE-2026-22555

Sources

• https://github.com/go-gitea/gitea/security/advisories/GHSA-fhx7-m96w-mv29
• https://github.com/go-gitea/gitea/blob/79f96b3e24/routers/api/v1/repo/fork.go#L135-L144