CVE-2026-86684

Published: Oct 6, 2026Modified: Oct 13, 2026

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 1.8 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.

Affected (1)

Products: Gitea: Gitea

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gitea Gitea	1.18.0 ≤ version < 28.1.0

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (5)

https://blog.gitea.com/release-of-28.1.0/

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

Release Notes

https://github.com/go-gitea/gitea/pull/39501

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

PatchIssue Tracking

https://github.com/go-gitea/gitea/pull/39507

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

PatchIssue Tracking

https://github.com/go-gitea/gitea/releases/tag/v28.1.0

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

Release Notes

https://github.com/go-gitea/gitea/security/advisories/GHSA-7v5j-mph8-9w6g

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

ExploitMitigationVendor Advisory

Timeline

No history available yet.