BIT-gitea-2026-89182

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/gitea/BIT-gitea-2026-89182.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-gitea-2026-89182

Aliases

CVE-2026-89182
GHSA-fx95-gwfc-grgc

Published

2026-10-14T08:43:04Z

Modified

2026-10-14T11:10:41Z

Summary

Gitea push-to-create bypass of FORCE_PRIVATE policy

Details

With [repository] FORCE_PRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*"
    ],
    "severity":  "Medium"
}

References

Affected packages

Bitnami / gitea

Package

Name: gitea
Purl: pkg:bitnami/gitea

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

1.27.0

Fixed

28.1.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/gitea/BIT-gitea-2026-89182.json"