CVE-2026-24451: Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

July 21, 2026

The POST /api/v1/repos/{owner}/{repo}/merge-upstream endpoint continues to synchronize commits from a parent repository after the parent repository has been changed from public to private.

A fork created while the parent repository was public can still receive commits made after the parent repository becomes private. As a result, content added during the private period becomes available through the fork repository after synchronization.

References

blog.gitea.com/release-of-1.26.3-and-1.26.4
github.com/advisories/GHSA-wrf9-r3h7-7x5v
github.com/go-gitea/gitea/pull/38151
github.com/go-gitea/gitea/releases/tag/v1.26.3
github.com/go-gitea/gitea/security/advisories/GHSA-wrf9-r3h7-7x5v
nvd.nist.gov/vuln/detail/CVE-2026-24451

Code Behaviors & Features

Detect and mitigate CVE-2026-24451 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →