Bug 2496944 (CVE-2026-22555)

A flaw was found in Gitea. An API (Application Programming Interface) endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to bypass authorization controls and create a new repository. By exploiting this, an attacker could gain administrative privileges on the forked repository, enable Actions, and push malicious workflow files, leading to the exfiltration of sensitive organization-level Continuous Integration/Continuous Delivery (CI/CD) secrets, such as deploy keys and cloud credentials.