CVE-2026-22555

Описание

Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

A flaw was found in Gitea. An API (Application Programming Interface) endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to bypass authorization controls and create a new repository. By exploiting this, an attacker could gain administrative privileges on the forked repository, enable Actions, and push malicious workflow files, leading to the exfiltration of sensitive organization-level Continuous Integration/Continuous Delivery (CI/CD) secrets, such as deploy keys and cloud credentials.