Gitea Fork Sync Information Disclosure

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-24451

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	1.26.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea version 1.26.2 allows fork synchronization to continue even after the parent repository has been changed from public to private.

As a result, data from the now-private parent repository can still be exposed to the fork, which should no longer have authorization to access that data.

Impact Analysis

The vulnerability can lead to unauthorized exposure of private repository data to forks that should no longer have access.

This means sensitive or confidential information could be leaked, potentially compromising project security and privacy.

Hi! I’m here to help you understand CVE-2026-24451. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70