Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets. This access‑control bypass permits the creation of a repository inside an organization, giving the attacker read access to any secrets stored there. The weakness is a misimplementation of the intended repository creation authorization.

The vulnerability affects Gitea Open Source Git Server. Versions before 1.26.0 are impacted; later versions are not listed as vulnerable.

The CVSS score of 8.1 indicates a high severity and a broad potential impact on confidentiality of organization secrets. The EPSS score is less than 1 %, implying a low but nonzero likelihood of exploitation. The flaw is not currently listed in the CISA KEV catalog. The likely attack vector is through the API: an attacker who can call the fork endpoint may create a repository inside an organization without passing the CanCreateOrgRepo check, thereby exposing stored secrets. Successful exploitation could allow adversaries full access to secret tokens and environment variables stored in the organization repository. No external code execution or denial of services is described, but the confidentiality damage is significant.