CVE-2026-26292CWE-284

Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions

Critical · published July 3, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00652 · 50.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
    cvelistv5