CVE-2026-26292
Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
- State
- Published
- Severity
- 9.8 Critical
- Published
- Jul 3, 2026
- Updated
- Jul 7, 2026
- Reserved
- Feb 22, 2026
Description
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Gitea Open Source Git ServerGitea |
|
References
- GitHub Pull Request #36665patch
- GitHub Pull Request #36691patch
- Gitea v1.25.5 Releaserelease-notes
- Gitea v1.25.5 Release Blog Postrelease-notes
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.