Gitea contains an authorization bypass vulnerability in its API fork endpoint that allows organization members to create repositories despite restrictions. The API endpoint for forking repositories into organizations only checks if the user is a member, not whether they have permission to create repositories. This contrasts with the web UI and other API endpoints that enforce stricter repository creation permissions. The issue affects Gitea versions prior to 1.26.0. Exploiting this flaw allows unauthorized repository creation within organizations, potentially increasing attack surface depending on organizational configurations.