External risk intelligence

Gitea Repository Creation Validation Flaw

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-22547

Gitea is a self-hosted Git service commonly deployed as an internet-facing application, web portal, or developer collaboration gateway. Because these instances often provide public or partner access to code repositories and are frequently exposed on the internet to facilitate remote development workflows, the attack surface is considered likely to be internet-reachable.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Gitea, a self-hosted Git service, due to missing validation on repository creation fields. This could allow for the creation of repositories with unexpected or malicious configurations, potentially impacting the integrity and confidentiality of stored code and data. The main concern is confirming relevance and exposure to Gitea instances within the organization.

Unvalidated fields in repository creation.
Affects how code is managed and secured.
Confirm if Gitea is used and its exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by creating a new repository without proper input validation on specific fields. If successful, this could allow an attacker to manipulate how the repository is stored or processed.

No authentication required to start.
Create a repository with malformed fields.
Enables attackers to control repository data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the integrity and confidentiality of repository data by allowing the creation of repositories with improperly validated fields. When supported by the advisory, this could lead to unexpected system behavior when processing malformed repository data. No Personally Identifiable Information (PII) risk is indicated by the provided context.

Repository data integrity and confidentiality.
Malformed repository data processing.
Unexpected system behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

The discovery of unvalidated repository creation fields in Gitea, particularly concerning template fields and trust model values, indicates a critical vulnerability that could allow for unauthorized actions. Owners of Gitea instances, likely platform or infrastructure teams depending on deployment, should prioritize identifying all deployments, assessing their exposure and business criticality, and coordinating with vendor management or security teams to plan remediation.

Platform or infrastructure teams own this.
Verify Gitea instance exposure and criticality.
Plan remediation through vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Gitea?

Gitea is an open-source, self-hosted Git server that provides a web-based interface for managing source code, repositories, and developer collaboration. It is commonly used by organizations as a central platform for hosting project codebases, managing pull requests, and facilitating team workflows, often serving as an alternative to hosted platforms like GitHub or GitLab.

What does CVE-2026-22547 mean?

This vulnerability, classified as Improper Input Validation (CWE-20), occurs because Gitea fails to properly constrain data entered during repository creation. By not enforcing limits on fields like templates or trust models, the software may accept malformed inputs that alter how the repository is processed, potentially allowing unauthorized manipulation of system data or configuration settings.

How can an attacker trigger this vulnerability?

An attacker can trigger this issue by submitting specially crafted inputs during the repository creation process. Because the application lacks necessary validation checks, it may process these malformed fields without requiring authentication. Note that standard repository operations that do not involve setting these specific, unvalidated configuration fields are not the primary target of this flaw.

Is my Gitea instance at risk?

According to Halo Surface Signal, Gitea is frequently deployed as an internet-facing portal to support remote development, making it highly likely that your instance is reachable from the public internet. If your installation is accessible without restricted access controls, it carries a higher risk profile regarding this specific repository configuration vulnerability.

How should I respond to this Gitea vulnerability?

Begin by identifying all Gitea deployments within your environment to assess their role and internet exposure. Prioritize updating these instances to the secure version, as remediation requires applying the vendor-provided patch. Coordinate with your infrastructure or platform teams to ensure the update is tested and deployed in accordance with your organization's maintenance schedule.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.