---
id: GO-2026-6074
aliases:
  - GHSA-rjvx-x5h2-6px5
title: >-
  Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to
  Bypass Repository Creation Restrictions in code.gitea.io/gitea
summary: >-
  Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to
  Bypass Repository Creation Restrictions in code.gitea.io/gitea
severity: none
vendor: gitea
product: code.gitea.io/gitea
ecosystem: go
affected:
  - code.gitea.io/gitea < 1.26.0
patched:
  - code.gitea.io/gitea 1.26.0
published: '2026-07-27'
updated: '2026-07-27'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6074'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-rjvx-x5h2-6px5'
  - url: >-
      https://github.com/go-gitea/gitea/commit/686d10b7f0c26baf91171124b382cbcdfa7bf025
  - url: 'https://github.com/go-gitea/gitea/pull/36950'
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v1.26.0'
tags:
  - osv
  - go
ingestedAt: '2026-07-27T19:08:56.091Z'
---

## Overview

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea

## Affected packages

- `code.gitea.io/gitea < 1.26.0`

## Remediation

Upgrade to a patched release:

- `code.gitea.io/gitea 1.26.0`