What’s Vulnerable › Vulnerabilities

CVE-2026-89182: Gitea push-to-create bypass of FORCE_PRIVATE policy

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-13
• Weakness: CWE-863

Description

With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.

Affected products

• Gitea Open Source Git Server: from 1.27.0 before 28.1.0 — fixed in 28.1.0

How to fix

Upgrade to a fixed version: Gitea Open Source Git Server 28.1.0. Check the vendor advisory for mitigations.

References

• https://blog.gitea.com/release-of-28.1.0/
• https://github.com/go-gitea/gitea/pull/39501
• https://github.com/go-gitea/gitea/pull/39507
• https://github.com/go-gitea/gitea/releases/tag/v28.1.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-fx95-gwfc-grgc
• https://github.com/go-gitea/gitea/security/advisories/GHSA-fx95-gwfc-grgc

Get alerted when CVE-2026-89182 or the next vulnerability affects your stack