CVE-2026-22555: Gitea Authorization Bypass Allows Secret Exposure via Repository Forking

Technical summary

The vulnerability stems from incomplete authorization validation in Gitea's repository forking API. When a user initiates a fork operation targeting an organization, the application fails to enforce the CanCreateOrgRepo permission check before permitting the fork. This allows an authenticated attacker with minimal privileges to fork repositories into organizations where they lack repository creation rights. The bypass exposes sensitive data stored in organization-level secrets, which are typically restricted to organization members with appropriate roles. The flaw affects all Gitea versions released before 1.26.0 and is classified under CWE-284 (Improper Access Control).

Business impact

For organizations using Gitea as their primary Git hosting platform, this vulnerability creates a serious confidentiality breach risk. Attackers with valid Gitea accounts—whether employees, contractors, or provisioned service accounts—can gain unauthorized access to organization secrets without detection through normal permission models. This exposure may include API tokens, deployment credentials, encryption keys, or other sensitive configuration data. In regulated environments or those handling sensitive IP, the unauthorized disclosure could trigger compliance violations. The attack requires no privilege escalation, making it accessible to any authenticated user, which significantly broadens the potential threat surface in larger deployments.

Affected systems

Gitea versions prior to 1.26.0 are affected. Self-hosted Gitea instances that expose API access to users—whether internal teams, external collaborators, or automated systems—are at risk. Organizations using Gitea as a central repository manager are particularly exposed if they store secrets at the organization level and rely on the permission model to restrict access. The vulnerability does not affect SaaS offerings or externally managed Gitea instances unless they run vulnerable versions.

Exploitability

Exploitation requires valid Gitea API credentials but no advanced techniques. An attacker with a standard user account can immediately exploit this flaw using the standard fork API endpoint, specifying an organization they wish to target. The attack leaves minimal forensic traces beyond standard audit logs that may not be monitored for fork operations. The low attack complexity and straightforward exploitation path make this a high-priority remediation target, particularly in environments where user provisioning is frequent or access control hygiene is not strictly enforced.

Remediation

Upgrade Gitea to version 1.26.0 or later. This release includes the CanCreateOrgRepo authorization check in the fork API, preventing unprivileged users from forking repositories into organizations without explicit permission. Verify the upgrade through vendor advisories and release notes before deployment. Organizations unable to upgrade immediately should implement compensating controls: restrict API access to trusted users, monitor organization-level secret access logs for anomalous activity, and audit recent repository forks for unauthorized organization-target patterns.

Patch guidance

Gitea administrators should prioritize upgrading to 1.26.0 or later as soon as feasible. Test the upgrade in a non-production environment first to ensure compatibility with local configurations and integrations. Post-upgrade, verify that the CanCreateOrgRepo permission is now enforced by attempting to fork a repository as a non-organization member—the operation should be denied. Review recent audit logs for any suspicious fork operations that may indicate prior exploitation. If your deployment has custom integrations or automation that performs forking, test those workflows after upgrade to confirm they continue to function as expected.

Detection guidance

Monitor Gitea audit logs and API request logs for fork operations targeting organizations. Look for patterns where users fork repositories into organizations where they are not members or lack repository creation privileges. Examine the 'action' field in audit logs for 'fork_repo' events and correlate the user with organization membership. Configure alerting on fork operations that cross organization boundaries or target sensitive organizations. Additionally, review organization-level secret access logs for unauthorized reads, particularly from user accounts recently observed forking repositories. In environments with comprehensive logging, correlate fork operations with subsequent secret access to identify exploitation chains.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS score (8.1), low attack complexity, and direct exposure of sensitive organizational secrets. The requirement for only basic authentication makes exploitation accessible to a broad attacker pool in typical enterprise Gitea deployments. The confidentiality impact is severe—organizational secrets are designed to be restricted—and the authorization bypass is a fundamental control failure rather than a minor logic flaw. Organizations should treat this as a critical remediation target, particularly if they store cryptographic keys, API tokens, or deployment credentials in organization secrets.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: Network accessibility (AV:N) allows remote exploitation via API; Low attack complexity (AC:L) means standard API calls suffice; Privilege escalation is not required but low-privilege authentication is needed (PR:L); No user interaction is required (UI:N); Confidentiality impact is high (C:H) as organization secrets are exposed; Integrity impact is high (I:H) as forked repositories could be modified or used for supply chain attacks; Availability is not impacted (A:N). The score appropriately emphasizes the ease of exploitation and severity of secret exposure.

Frequently asked questions