BIT-GITEA-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

CVE-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

CVE-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

CVE-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy

With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...

CVE-2026-89182

A flaw in Gitea allows authenticated users with repository creation privileges to bypass instance privacy policies. When [repository] FORCE_PRIVATE = true is enabled, the post-receive hook incorrectly applies the repo.private=false push option to empty repositories created via push. This allows u...