Critical severity · published Jul 3, 2026
CVE-2026-26292
Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
Gitea Open Source Git Server · Gitea
before 1.25.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26292
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26292
blog.gitea.com
https://blog.gitea.com/release-of-1.25.5/
github.com
https://github.com/go-gitea/gitea/pull/36665
github.com
https://github.com/go-gitea/gitea/pull/36691
github.com
https://github.com/go-gitea/gitea/releases/tag/v1.25.5
More from Gitea Open Source Git Server
9.8
CVE-2026-56654
Privilege Escalation via Access Token Scope Escalation in API
9.8
CVE-2026-58422
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
9.8
CVE-2026-27780
Gitea pre-receive hook can miss branch-protection checks after scanner errors
9.8
CVE-2026-20896
Gitea Docker image trusts spoofable reverse-proxy headers by default
9.6
CVE-2026-56443
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118