{"id":"EUVD-2026-41617","enisaUuid":"61a8fefa-dc70-3b83-9b17-5bd35f7c3dca","description":"Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.","datePublished":"Jul 3, 2026, 8:19:30 PM","dateUpdated":"Jul 6, 2026, 8:23:09 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fhx7-m96w-mv29\nhttps://github.com/go-gitea/gitea/pull/36950\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.0\nhttps://blog.gitea.com/release-of-1.26.0/\n","aliases":"CVE-2026-22555\nGHSA-fhx7-m96w-mv29\n","assigner":"Gitea","epss":0.39,"enisaIdProduct":[{"id":"1c241aaf-ae42-34fb-a427-ecaddc28134a","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.26.0"}],"enisaIdVendor":[{"id":"2e860fa7-dc79-310c-983b-57f9aec61cf3","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"26e34568-8b8d-3d2e-ae5d-2a12a709a3b8","vulnerability":{"id":"CVE-2026-22555","description":"Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.","datePublished":"Jul 3, 2026, 8:19:30 PM","dateUpdated":"Jul 6, 2026, 8:23:09 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fhx7-m96w-mv29\nhttps://github.com/go-gitea/gitea/pull/36950\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.0\nhttps://blog.gitea.com/release-of-1.26.0/\n","enisa_id":"EUVD-2026-41617\n","assigner":"Gitea","epss":0.39,"dataProcessed":"Nov 4, 2026, 7:19:11 AM","vulnerabilityProduct":[{"id":"96582963-fda8-3c49-82ad-f9ffcf08e2c4","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.26.0"}],"vulnerabilityVendor":[{"id":"2e9d1837-7ec4-31ed-abbd-26cf9a50b07b","vendor":{"name":"Gitea"}}]}},{"id":"54510f54-5f09-3c3e-97d1-38a051af52b1","vulnerability":{"id":"GHSA-fhx7-m96w-mv29","description":"Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration","datePublished":"Jun 17, 2026, 6:08:00 PM","dateUpdated":"Jun 17, 2026, 6:08:00 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fhx7-m96w-mv29\nhttps://github.com/go-gitea/gitea\n","enisa_id":"EUVD-2026-41617\n","aliases":"GHSA-fhx7-m96w-mv29\nCVE-2026-22555\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}