CVE-2026-89182

Published: Oct 6, 2026Modified: Oct 13, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.

Affected (1)

Products: Gitea: Gitea

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gitea Gitea	1.27.0 ≤ version < 28.1.0

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (6)

https://blog.gitea.com/release-of-28.1.0/

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

Release Notes

https://github.com/go-gitea/gitea/pull/39501

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

PatchIssue Tracking

https://github.com/go-gitea/gitea/pull/39507

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

PatchIssue Tracking

https://github.com/go-gitea/gitea/releases/tag/v28.1.0

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

Release Notes

https://github.com/go-gitea/gitea/security/advisories/GHSA-fx95-gwfc-grgc

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

MitigationVendor Advisory

https://github.com/go-gitea/gitea/security/advisories/GHSA-fx95-gwfc-grgc

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

MitigationVendor Advisory

Timeline

No history available yet.