GitHub Advisoryadvisory · Go

GHSA-rc56-rj3f-xggf Gitea LFS mirror operations bypass migration HTTP transport protections

CRITICAL Published 2026-07-03 Modified 2026-09-01 Official page ↗
Aliases
CVE-2026-26292
Ecosystem
Go
Packages
code.gitea.io/gitea
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2026-09-01

Affected packages

• Go code.gitea.io/gitea: < 1.25.5 → fixed in 1.25.5

Description

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

Related

Alias · CVE (1)

  • CVE-2026-26292 Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References