{"id":"GO-2026-6074","aliases":["GHSA-rjvx-x5h2-6px5"],"title":"Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea","summary":"Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea","severity":"none","vendor":"gitea","product":"code.gitea.io/gitea","ecosystem":"go","affected":["code.gitea.io/gitea < 1.26.0"],"patched":["code.gitea.io/gitea 1.26.0"],"published":"2026-07-27","updated":"2026-07-27","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6074","references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rjvx-x5h2-6px5"},{"url":"https://github.com/go-gitea/gitea/commit/686d10b7f0c26baf91171124b382cbcdfa7bf025"},{"url":"https://github.com/go-gitea/gitea/pull/36950"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.0"}],"tags":["osv","go"],"ingestedAt":"2026-07-27T19:08:56.091Z","slug":"GO-2026-6074","body":"## Overview\n\nGitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea\n\n## Affected packages\n\n- `code.gitea.io/gitea < 1.26.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `code.gitea.io/gitea 1.26.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}