{"id":"EUVD-2026-41619","enisaUuid":"27177d39-3371-3c27-82cf-363fcf4d4b0a","description":"Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.","datePublished":"Jul 3, 2026, 8:19:31 PM","dateUpdated":"Jul 7, 2026, 5:00:21 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wrf9-r3h7-7x5v\nhttps://github.com/go-gitea/gitea/pull/38151\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","aliases":"CVE-2026-24451\nGHSA-wrf9-r3h7-7x5v\n","assigner":"Gitea","epss":0.45,"enisaIdProduct":[{"id":"0a5ccf60-f426-32ab-ac82-1b2508c0ab22","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"1.26.2"}],"enisaIdVendor":[{"id":"da93fadb-550e-350a-a70a-4deb63b768a5","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"3448dbbb-ab38-35e8-81c5-3add5fc98b4b","vulnerability":{"id":"CVE-2026-24451","description":"Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.","datePublished":"Jul 3, 2026, 8:19:31 PM","dateUpdated":"Jul 7, 2026, 5:00:21 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wrf9-r3h7-7x5v\nhttps://github.com/go-gitea/gitea/pull/38151\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","enisa_id":"EUVD-2026-41619\n","assigner":"Gitea","epss":0.45,"dataProcessed":"Nov 1, 2026, 4:03:10 AM","vulnerabilityProduct":[{"id":"566f7f6d-bf82-32f4-980c-b5c60b676194","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"1.26.2"}],"vulnerabilityVendor":[{"id":"11935216-b34d-3637-bd00-7c6dbba5f230","vendor":{"name":"Gitea"}}]}},{"id":"87b8b2e7-a86b-302b-b006-09a6f3a75e7a","vulnerability":{"id":"GHSA-wrf9-r3h7-7x5v","description":"Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private","datePublished":"Jul 21, 2026, 9:42:28 PM","dateUpdated":"Jul 21, 2026, 9:42:28 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wrf9-r3h7-7x5v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-24451\nhttps://github.com/go-gitea/gitea/pull/38151\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\n","enisa_id":"EUVD-2026-41619\n","aliases":"CVE-2026-24451\nGHSA-wrf9-r3h7-7x5v\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}