CVE-2026-26292

Published: Jul 3, 2026Modified: Jul 7, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (4)

https://blog.gitea.com/release-of-1.25.5/

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/pull/36665

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/pull/36691

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/releases/tag/v1.25.5

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

Timeline

No history available yet.