Incorrect authorization in Gitea - CVE-2026-89182
Published: October 19, 2026
Vulnerability identifier: #VU156110
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89182
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass the server's private-repository policy and make their own repository and its contents publicly accessible.
The vulnerability exists due to incorrect authorization in Gitea's hookPostReceiveUpdateRepoByOptions function when processing push options on the first push to an empty repository. A remote user can submit git push -o repo.private=false to a repository they administer to change its visibility to public without enforcement of the server-level visibility policy.
Only instances configured with FORCE_PRIVATE = true are affected; this setting is disabled by default.
Affected software
Gitea
How to mitigate CVE-2026-89182
Install security update from vendor's website.
Gitea - update to 28.1.0