CVEvulnerability
CVE-2026-26292
9.8 CRITICAL
Official page ↗
- Status
- Deferred
- Published
- 2026-07-03
- Last modified
- 2026-10-25
- Assigner
- 88ee5874-cf24-4952-aea0-31affedb7ff2
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-284
Description
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://blog.gitea.com/release-of-1.25.5/ blog.gitea.com
- https://github.com/go-gitea/gitea/pull/36665 github.com
- https://github.com/go-gitea/gitea/pull/36691 github.com
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5 github.com