CVE-2026-89182

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description When the configuration [repository] FORCE PRIVATE = true is enabled, Gitea is intended to create all new repositories as private. However, a flaw in the post-receive hook allows the repo.private=false push option to be applied to empty repositories created via push. This allows users with repository creation privileges to make new repositories public, bypassing the instance policy. The default configuration is not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.