CVE-2026-22547 Gitea CVE debrief

Who should care

Administrators and users of Gitea versions before 1.25.5 should prioritize updating to the latest version to prevent potential repository creation validation bypasses. This vulnerability has a critical CVSS score of 9.1 and impacts Gitea instances. Security teams and operators managing Gitea deployments should review and adjust repository creation fields and validation constraints.

Technical summary

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values. This vulnerability, with a CVSS score of 9.1, allows for critical exploitation. The vulnerability impacts repository creation and can be exploited to bypass validation. Updating to version 1.25.5 or later is recommended to address this vulnerability.

Defensive priority

High priority should be given to updating Gitea instances to version 1.25.5 or later to address the repository creation validation bypass vulnerability.

Recommended defensive actions

• Update Gitea to version 1.25.5 or later
• Review and adjust repository creation fields and validation constraints
• Monitor for suspicious repository creation activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is based on limited source detail, primarily from the NVD and Gitea release notes. Further verification is recommended. The CVE record was published on 2026-07-03T21:16:56.890Z and has not been modified since then. Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values. This vulnerability allows for critical exploitation with a CVSS score of 9.1.

Official resources