CVE-2026-22555
published 2026-07-03CVE-2026-22555: Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose…
PriorityP351high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.30%
23.2th percentile
Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.26.0 | 1.26.0 |
| gitea | gitea_open_source_git_server | < 1.26.0 | 1.26.0 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
code.gitea.io/gitea: Gitea: Organization Secret Exfiltration via API Fork Missing Authorization Check
vendor_redhat·2026-07-03·CVSS 8.1
CVE-2026-22555 [HIGH] CWE-639 code.gitea.io/gitea: Gitea: Organization Secret Exfiltration via API Fork Missing Authorization Check
code.gitea.io/gitea: Gitea: Organization Secret Exfiltration via API Fork Missing Authorization Check
Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.
A flaw was found in Gitea. An API (Application Programming Interface) endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to bypass authorization controls and create a new repository. By exploiting this, an attacker could gain administrative privileges on the forked repository, enable Actions, and push malicious workflow files, leading to the e
GHSA
Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
ghsa·2026-06-17
CVE-2026-22555 [HIGH] CWE-863 Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
## Summary
The API endpoint `POST /api/v1/repos/{owner}/{repo}/forks` only checks `IsOrgMember()` when a user forks a repository into an organization, but does not check `CanCreateOrgRepo()`. The web UI fork handler correctly checks both. This allows a read-only organization member — in a team with `can_create_org_repo=false` — to create repositories in the organization namespace via the API. The attacker receives full admin permissions on the forked repository, can enable Actions, push arbitrary workflow files, and exfiltrate all organization-level CI/CD secrets (deploy keys, cloud credentials, API tokens) through the runner infrastructure.
## Steps To Reproduce
### 1. Environment setup
Start a Gitea instan
No detection rules found.
No public exploits indexed.
2026-07-03
Published