CVE-2026-26292 — Vulnerability in code.gitea.io/gitea — CVE Details

CRITICAL

Gitea LFS mirror operations bypass migration HTTP transport protections

Published July 3, 2026Updated September 10, 2026Source: osv

Summary

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

Advisory Timeline

First published July 3, 2026 (101 days ago).
Last revised September 10, 2026 — 69 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update code.gitea.io/gitea to 1.25.5 or later

go get code.gitea.io/gitea@v1.25.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
code.gitea.io/gitea	go	All versions	1.25.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-284
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-26292?: Gitea LFS mirror operations bypass migration HTTP transport protections This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-26292?: CVE-2026-26292 affects code.gitea.io/gitea. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-26292 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-rc56-rj3f-xggf

GO-2026-6344

Related CVEs

CVE-2026-22874
CRITICAL
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
CVE-2019-11576
CRITICAL
Gitea Allows 1FA Even for 2FA-Enrolled Accounts
CVE-2026-58426
CRITICAL
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
CVE-2026-26247
CRITICAL
Gitea OAuth2 PKCE S256 verifier bypass
CVE-2026-56750
CRITICAL
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
CVE-2026-27780
CRITICAL
Gitea pre-receive hook scanner errors allow branch-protection bypass
CVE-2026-58443
CRITICAL
Gitea: Public-only repository tokens can update private PR head branches
CVE-2026-26231
HIGH
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies