https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:07:29.460658+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-12010 bdu:2026-12010 2026-10-03T07:07:29.569591+00:00 bdu:2026-12010 https://cve.radiocsirt.org/vuln/euvd-2026-333755 EUVD-2026-333755 2026-10-03T07:07:29.569647+00:00 EUVD-2026-333755 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24451 fkie_cve-2026-24451 2026-10-03T07:07:29.569671+00:00

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

 https://cve.radiocsirt.org/vuln/ghsa-wrf9-r3h7-7x5v GHSA-wrf9-r3h7-7x5v — Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private 2026-10-03T07:07:29.569713+00:00

Affected: Go: code.gitea.io/gitea

### Summary

The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint continues to synchronize commits from a parent repository after the parent repository has been changed from public to private.

A fork created while the parent repository was public can still receive commits made after the parent repository becomes private. As a result, content added during the private period becomes available through the fork repository after synchronization.

### Details

Gitea provides the `merge-upstream` API to synchronize a fork with its parent repository.

A typical workflow is:

1. A repository is public. 2. Another user creates a fork. 3. The fork owner uses `merge-upstream` to receive updates from the parent repository.

However, if the parent repository is later changed from public to private, the synchronization endpoint continues to import new commits from the parent repository into the fork.

In testing on Gitea 1.26.2, a fork owner who can no longer directly access the parent repository is still able to synchronize newly created commits from the parent repository into the fork by calling `merge-upstream`.

As a result, commits created after the visibility change can be propagated into the fork through the normal fork synchronization workflow.

### PoC

#### Proof-of-Concept Code

https://anonymous.4open.science/r/Gitea_PoC-EC93/4_poc_merge_upstream

#### PoC Details

1. User `alice` creates a public repository `alice/P`. 2. User `bob` forks the repository, creating `b…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2027 WID-SEC-W-2026-2027 — Gitea: Mehrere Schwachstellen 2026-10-03T07:07:29.569796+00:00

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.