Vulnerability in Gitea

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.

[ Fixes ]Fixes and patches

• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

• BSI CERT-Bund6 Oct 2026WID-SEC-2026-3792

  Gitea: Multiple vulnerabilities Translated from German

  CVE-2026-103670CVE-2026-94205CVE-2026-103059+26 more CVEs

[ References ]References

• blog.gitea.com/release-of-28.1.0Release Notes
• github.com/go-gitea/gitea/pull/39501PatchIssue Tracking
• github.com/go-gitea/gitea/pull/39507PatchIssue Tracking
• github.com/go-gitea/gitea/releases/tag/v28.1.0Release Notes
• github.com/go-gitea/gitea/security/advisories/GHSA-fx95-gwfc-grgcMitigationVendor Advisory