CyberRota Analysis
AI-GeneratedGitea instances configured with `[repository] FORCE_PRIVATE = true` are vulnerable as they allow users to create new repositories as private, yet still permit the `repo.private=false` push option to be applied, potentially exposing these repositories publicly. This misconfiguration can lead to unauthorized access to sensitive data for any user with repository creation privileges. Organizations using Gitea with this setting should prioritize remediation to ensure compliance with their privacy policies.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.
Related CVEs
Other vulnerabilities affecting the same vendor(s)