CVE-2026-86684CWE-863broken-access-control

CVE-2026-86684

High · published October 7, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
1.4
In the wild
Unconfirmed
What it is

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00114 · 1.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-07T02:17Z
Affected products (1)
ProductVersionsFixed in
gitea/gitea≥ 1.18.0, < 28.1.028.1.0
References (5)
https://blog.gitea.com/release-of-28.1.0/ · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/pull/39501 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/pull/39507 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/releases/tag/v28.1.0 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/security/advisories/GHSA-7v5j-mph8-9w6g · 88ee5874-cf24-4952-aea0-31affedb7ff2
EPSS history
Timeline
  • 08 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 06 OCT 21:17Z
    Gitea push mirror local path check uses the repository owner
    cvelistv5