CVE-2026-22555

Summary

Gitea before 1.26.0 is missing a `CanCreateOrgRepo` permission check on its fork API (CVE-2026-22555). A user without permission to create repositories in an organization could fork into it and, in doing so, exfiltrate the organization's secrets. It is a broken-authorization flaw that leaks organization and CI/CD secrets to users who should not have access to them.

How to fix it

• Upgrade Gitea to 1.26.0 or later, which enforces the missing repository-creation permission on the fork API.
• Rotate any organization or CI/CD secrets that could have been exposed, and review organization membership and recent fork activity.

How to avoid it in your code

• Enforce the same permission checks on API endpoints as on the UI; an authorization check forgotten on an API path is a classic broken-access-control bug.
• Scope secrets to the smallest set of repositories and actors that need them, and rotate on any suspected exposure.
• Keep your forge patched and audit who can create or fork repositories in sensitive organizations.

References

• https://github.com/go-gitea/gitea/security/advisories/GHSA-fhx7-m96w-mv29
• https://nvd.nist.gov/vuln/detail/CVE-2026-22555
• https://github.com/go-gitea/gitea