CVE-2026-24451
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability in Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, leading to unauthorized data exposure.
Risk Assessment
The organization risks data leakage when a repository is made private but its fork continues to sync, exposing confidential information to unauthorized users.
Recommendation
Immediately upgrade Gitea to version 1.26.3 or later, which includes a fix preventing fork synchronization after the repository status changes to private.
Other vulnerabilities in Gitea
See all- CVE-2026-60004CriticalActively exploited
Gitea before version 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- CVE-2026-58508Critical
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation).
- CVE-2026-58443Critical
Public-only repository tokens can update private PR head branches.
- CVE-2026-58433Critical
The team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting. This means a user without proper permissions can change repository-team assignments.
- CVE-2026-56750Critical
Theft of the Remember-Me token in Gitea does not invalidate the attacker's session, allowing continued unauthorized access.
- CVE-2026-56654Critical
The vulnerability allows privilege escalation via access token scope escalation in the API.
- CVE-2026-56443Critical
A public-only scope token can bypass restrictions on limited-visibility owners (Repository and Package categories) — residual after CVE-2026-25714 / PR #37118.
- CVE-2026-55982Critical
The OIDC userinfo endpoint returns identity claims without enforcing API token scopes.
- CVE-2026-58426Critical
The vulnerability in Gitea Actions Artifacts V4 stems from HMAC ambiguity in signed URLs, allowing cross-repository artifact read and cross-task upload-state write.
- CVE-2026-27780Critical
A vulnerability in Gitea before version 1.26.0 fails to close the connection on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.
Original NVD description (English source)
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.