CVE-2026-89182

In Gitea , a vulnerability exists where users can bypass the [repository] FORCE_PRIVATE = true policy. When an empty repository is created via a push, the post-receive hook incorrectly applies the repo.private=false push option, making the new repository public despite the instance policy. This i...