Information disclosure in Gitea Open Source Git Server
CVE-2026-24451
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.
Vulnerability class: Information Disclosure
Affected products
- Gitea Open Source Git Server — versions 1.26.2
Weakness classification (CWE)
References
- 88ee5874-cf24-4952-aea0-31affedb7ff2 (vendor-advisory)
- 88ee5874-cf24-4952-aea0-31affedb7ff2 (patch)
- 88ee5874-cf24-4952-aea0-31affedb7ff2 (release-notes)
- 88ee5874-cf24-4952-aea0-31affedb7ff2 (release-notes)