Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
Gitea contains an authorization bypass vulnerability in its API fork endpoint that allows organization members to create repositories despite restrictions. The API endpoint for forking repositories into organizations only checks if the user is a member, not whether they have permission to create repositories. This contrasts with the web UI and other API endpoints that enforce stricter repository creation permissions. The issue affects Gitea versions prior to 1.26.0. Exploiting this flaw allows unauthorized repository creation within organizations, potentially increasing attack surface depending on organizational configurations.
AI Analysis
Technical Summary
The API endpoint POST /api/v1/repos/{owner}/{repo}/forks in Gitea performs a weaker authorization check compared to the web UI and other repository creation endpoints. It verifies only that the user is an organization member (IsOrgMember) but does not verify if the user has repository creation rights (CanCreateOrgRepo). Consequently, organization members in teams with can_create_org_repo=false can bypass restrictions and create repositories by forking via the API. This discrepancy leads to an authorization bypass vulnerability classified as CWE-863. The vulnerability was confirmed in Gitea version 1.23.7 and affects all versions prior to 1.26.0.
Potential Impact
Users who are members of an organization but are explicitly denied repository creation permissions can circumvent these restrictions using the API fork endpoint. This unauthorized repository creation may expose additional attack surface depending on the organization's Actions, runner, and workflow configurations. The vulnerability undermines intended access controls and could lead to unintended repository proliferation within organizations.
Mitigation Recommendations
A fix is available in Gitea version 1.26.0 and later. Users should upgrade to version 1.26.0 or above to ensure the API fork endpoint enforces the correct repository creation permissions. Until upgraded, organizations should be aware that members with restricted repository creation rights can bypass these restrictions via the API fork endpoint.
Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
Description
Gitea contains an authorization bypass vulnerability in its API fork endpoint that allows organization members to create repositories despite restrictions. The API endpoint for forking repositories into organizations only checks if the user is a member, not whether they have permission to create repositories. This contrasts with the web UI and other API endpoints that enforce stricter repository creation permissions. The issue affects Gitea versions prior to 1.26.0. Exploiting this flaw allows unauthorized repository creation within organizations, potentially increasing attack surface depending on organizational configurations.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The API endpoint POST /api/v1/repos/{owner}/{repo}/forks in Gitea performs a weaker authorization check compared to the web UI and other repository creation endpoints. It verifies only that the user is an organization member (IsOrgMember) but does not verify if the user has repository creation rights (CanCreateOrgRepo). Consequently, organization members in teams with can_create_org_repo=false can bypass restrictions and create repositories by forking via the API. This discrepancy leads to an authorization bypass vulnerability classified as CWE-863. The vulnerability was confirmed in Gitea version 1.23.7 and affects all versions prior to 1.26.0.
Potential Impact
Users who are members of an organization but are explicitly denied repository creation permissions can circumvent these restrictions using the API fork endpoint. This unauthorized repository creation may expose additional attack surface depending on the organization's Actions, runner, and workflow configurations. The vulnerability undermines intended access controls and could lead to unintended repository proliferation within organizations.
Mitigation Recommendations
A fix is available in Gitea version 1.26.0 and later. Users should upgrade to version 1.26.0 or above to ensure the API fork endpoint enforces the correct repository creation permissions. Until upgraded, organizations should be aware that members with restricted repository creation rights can bypass these restrictions via the API fork endpoint.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rjvx-x5h2-6px5
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a600aba9c2644c7f8fe2ab8
Added to database: 07/22/2026, 00:11:38 UTC
Last enriched: 07/22/2026, 00:51:39 UTC
Last updated: 07/31/2026, 12:28:12 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.