GHSA-rc56-rj3f-xggf
Gitea LFS mirror operations bypass migration HTTP transport protections
At a glance
- Published
- Updated
- CVE
- CVE-2026-26292
- Aliases
- GO-2026-6344
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
Affected packages
| Package | Versions |
|---|---|
| Go · code.gitea.io/gitea | introduced 0, fixed 1.25.5 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-26292 ADVISORY
- https://github.com/go-gitea/gitea/pull/36665 WEB
- https://github.com/go-gitea/gitea/pull/36691 WEB
- https://github.com/go-gitea/gitea/commit/996cc12bf7d54ae2326f20b4211fff70eb31e74a WEB
- https://github.com/go-gitea/gitea/commit/bcd253a310115045d3ec5e8168a953fbee34dd28 WEB
- https://blog.gitea.com/release-of-1.25.5 WEB
- https://github.com/go-gitea/gitea PACKAGE
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |