CVE-2026-89182

Received Received - Intake

Gitea Repository Visibility Bypass via Push Option

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: Gitea Limited

Description

With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-06

Generated

2026-10-07

AI Q&A

2026-10-07

EPSS Evaluated

N/A

NVD

CVE-2026-89182

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	1.27.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in Gitea when the FORCE_PRIVATE setting is enabled. Normally, new repositories should be private, but a flaw in the post-receive hook allows the push option repo.private=false to override this setting for empty repositories created during a push. This lets users create public repositories despite the instance policy.

Impact Analysis

If you manage a Gitea instance with FORCE_PRIVATE=true, users could bypass the private repository policy by pushing to a new repository and setting it to public. This violates intended access controls and may expose sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized exposure of private data, potentially violating GDPR's data protection requirements or HIPAA's confidentiality rules if sensitive information is involved.

Mitigation Strategies

Review Gitea repository creation settings and ensure FORCE_PRIVATE is properly enforced. Check for any repositories created with incorrect visibility settings and correct them manually if needed.

Hi! I’m here to help you understand CVE-2026-89182. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70