Improper Authorization in Gitea - #VU135003
Published: June 22, 2026
Vulnerability identifier: #VU135003
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to create repositories in an organization without authorization.
The vulnerability exists due to improper access control in the fork repository API endpoint when handling fork requests into organizations. A remote user can send a specially crafted API request to create repositories in an organization without authorization.
The issue affects POST /api/v1/repos/{owner}/{repo}/forks because it checks organization membership but does not verify whether repository creation is permitted for that user in the target organization.
Affected software
Gitea
Remediation
Install security update from vendor's website.
Gitea - update to 1.23.8