CVE-2026-89182: Gitea push-to-create bypass of FORCE_PRIVATE policy
With [repository] FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must be able to create repositories and create a new empty repository through a push. They can then use the repo.private=false push option to make that repository public.
Are default Gitea installations affected?
No. The default configuration is not affected; the issue requires [repository] FORCE_PRIVATE = true.
How can I tell whether my instance may be affected?
Check whether [repository] FORCE_PRIVATE is enabled and whether users who can create repositories can push to create new empty repositories. Repositories created in that way may have been made public despite the private-only policy.