CVE-2026-22555: Gitea Auth Bypass Vulnerability

CVE-2026-22555 Overview

CVE-2026-22555 is a broken access control vulnerability in Gitea versions before 1.26.0. The Gitea API allows authenticated users to fork a repository into an organization without first passing the CanCreateOrgRepo permission check. This authorization gap enables users who lack repository creation privileges within an organization to create forks inside that organization. Because forked repositories inherit access to organization-level secrets and configuration, an attacker can extract sensitive data such as CI/CD credentials, deployment tokens, and API keys. The flaw is classified under CWE-284: Improper Access Control.

Critical Impact
Authenticated API users can bypass organization repository creation controls and expose organization secrets through unauthorized forks.

Affected Products

Gitea versions prior to 1.26.0
Self-hosted Gitea instances exposing the REST API
Organizations relying on CanCreateOrgRepo restrictions for secret isolation

Discovery Timeline

2026-07-03 - CVE-2026-22555 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-22555

Vulnerability Analysis

Gitea enforces organization-level repository creation through the CanCreateOrgRepo permission check. This control determines which organization members are allowed to instantiate new repositories under the organization namespace. The API fork endpoint in versions before 1.26.0 fails to invoke this check when the fork target is an organization.

An API user with authenticated access and permission to view a source repository can issue a fork request specifying an organization as the destination. The server accepts the request and creates the forked repository inside the organization without validating the requester's CanCreateOrgRepo status. Once the fork exists, it operates within the organization's trust boundary and can access organization secrets referenced by Gitea Actions workflows.

Root Cause

The root cause is a missing authorization check in the fork API handler. The endpoint validated read access to the source repository but did not validate write or creation permissions against the destination organization. This design flaw maps to CWE-284, where access decisions omit a required permission gate.

Attack Vector

Exploitation requires low-privileged authenticated access to the Gitea instance and network reachability to the API. An attacker sends a fork request through the REST API, targeting an organization where they lack repository creation rights. The forked repository inherits access paths to organization secrets, which the attacker can exfiltrate by pushing modified workflow definitions or reading configuration exposed to the fork. See the GitHub Security Advisory GHSA-fhx7-m96w-mv29 for coordinated disclosure details and the Gitea Pull Request #36950 for the patch implementation.

Detection Methods for CVE-2026-22555

Indicators of Compromise

Fork API requests to /api/v1/repos/{owner}/{repo}/forks where the organization parameter targets an org in which the caller is not a repo admin or owner
New repositories appearing under organization namespaces without corresponding audit entries for creation permissions
Workflow runs in forked repositories that reference or print organization-scoped secrets

Detection Strategies

Audit Gitea access logs for POST requests to the fork endpoint and correlate the authenticated user against the destination organization's membership roles
Compare repository creation events with the set of users holding CanCreateOrgRepo to surface out-of-policy forks
Review Gitea Actions job logs for unexpected secret references or exfiltration primitives such as curl, wget, or base64 calls in forked workflows

Monitoring Recommendations

Forward Gitea application and audit logs to a centralized log platform and alert on fork creation targeting organizations
Track secret access patterns and flag first-time use of an organization secret from a newly created repository
Establish a baseline of fork activity per user and alert on deviations, particularly forks into organizations with sensitive secrets

How to Mitigate CVE-2026-22555

Immediate Actions Required

Upgrade all Gitea instances to version 1.26.0 or later as documented in the Gitea 1.26.0 Release Notes
Rotate organization secrets, deployment tokens, and CI/CD credentials that may have been exposed to unauthorized forks
Audit existing forks within organizations and remove any created by users without CanCreateOrgRepo privileges

Patch Information

The fix is included in Gitea 1.26.0, released with the v1.26.0 release tag. The corrective code, delivered in Pull Request #36950, adds the missing CanCreateOrgRepo authorization check to the fork API handler before the destination repository is created.

Workarounds

Restrict API access to trusted users through network segmentation or reverse proxy authentication until patching is complete
Remove organization-level secrets from Gitea Actions configurations on affected instances and reissue them after upgrading
Disable the fork feature at the instance level or through organization settings if operational requirements permit

bash

# Verify the running Gitea version and upgrade if below 1.26.0
gitea --version

# Example upgrade path for binary installations
systemctl stop gitea
wget https://dl.gitea.com/gitea/1.26.0/gitea-1.26.0-linux-amd64 -O /usr/local/bin/gitea
chmod +x /usr/local/bin/gitea
systemctl start gitea