Unauthorized fork synchronization after visibility change in Gitea (CVE-2026-24451)

The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint in Gitea fails to enforce visibility restrictions when a parent repository is changed from public to private. A fork owner who no longer has access to the parent repository can still call the merge-upstream API to pull commits created after the visibility change into their fork. This allows content added during the private period to be retrieved through the fork repository. Affected versions: - 1.26.2 We recommend updating to: 1.26.3. CVSS 7.5 · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-wrf9-r3h7-7x5v Details: https://vuln.today/cve/CVE-2026-24451