Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-24451

Gitea fork synchronization can expose private parent repository data

Description

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Gitea Gitea Open Source Git Server

Default version status: unaffected

  • 1.26.2affected

References