CVE-2026-24451 is a vulnerability in Gitea Open Source Git Server version 1.26.2. The issue arises because fork synchronization does not stop when the parent repository changes from public to private, allowing the fork to retain access to data it should no longer have. This results in unauthorized information disclosure (CWE-200) and improper access control (CWE-284). The CVSS 3.1 base score is 7.5, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without affecting integrity or availability.

An attacker or user with access to a forked repository can continue to synchronize and access data from the parent repository after it has been made private. This leads to unauthorized disclosure of potentially sensitive information that should have been restricted following the visibility change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, administrators should manually verify repository visibility changes and consider restricting fork synchronization or access to forks when parent repositories are made private.