CVE-2026-22555

Name of the Vulnerable Software and Affected Versions Gitea version 1.23

Description An authorization inconsistency exists between the web UI and the API regarding repository forking. The API endpoint POST /api/v1/repos/{owner}/{repo}/forks fails to verify the CanCreateOrgRepo() permission, checking only IsOrgMember(). This allows a read-only organization member, specifically those in teams where can create org repo is set to false, to create repositories within the organization namespace via the API.

An attacker can exploit this by forking an existing repository back into the organization. Since the creator of the fork is granted full admin permissions, they can enable Actions and push malicious workflow files. Because the runner infrastructure and secret injection mechanisms rely on the organization's owner ID, the attacker can execute workflows that exfiltrate all organization-level CI/CD secrets, such as deploy keys, cloud credentials, and API tokens.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.