What is the CVSS score of CVE-2026-26292?

CVE-2026-26292 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Gitea are affected by CVE-2026-26292?

Gitea self-hosted deployments before version 1.25.5 are vulnerable to a bypass of repository migration security controls, enabling Git LFS operations to reach network destinations that would normally…. A patch is available.

How to fix or mitigate CVE-2026-26292?

Within 24 hours, audit all self-hosted Gitea instances in your environment and document current versions to establish the scope of exposure. Within 7 days, upgrade all instances before 1.25.5 to version 1.25.5 or later, with priority given to systems where non-administrative users can configure repository mirrors. Within 30 days, review Git LFS operation logs across all repository mirrors to detect any unauthorized requests to restricted or non-standard network destinations.

Gitea CVE-2026-26292

EUVD-2026-41630 CRITICAL

Improper Access Control (CWE-284)

2026-07-03 Gitea

GHSA-rc56-rj3f-xggf

Gitea Authentication Bypass Gitea Open Source Git Server

9.8

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Configuring a mirror requires an authenticated repo-privileged user (PR:L); the bypass primarily enables SSRF-style reach to blocked hosts (C:H), with limited integrity and no clear availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 18:32 vuln.today

Analysis Generated

Jul 22, 2026 - 18:32 vuln.today

CVE Published

Jul 03, 2026 - 20:19 cve.org

CRITICAL 9.8

CVE Published

Jul 03, 2026 - 20:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

AnalysisAI

Migration transport protections in Gitea are bypassed for Git LFS operations, affecting all self-hosted instances before version 1.25.5. Because LFS push and sync-mirror requests instantiated their client with a nil HTTP transport (lfs.NewClient(endpoint, nil)) instead of the hardened migration transport, LFS traffic escaped the allowlist/SSRF restrictions the migration transport enforces, letting a user who can configure a repository mirror direct LFS requests to otherwise-blocked destinations. There is no public exploit identified at time of analysis and EPSS is low (0.17%), but SSVC rates technical impact as total and automatable, and a vendor patch is available.

Technical ContextAI

Gitea is a self-hosted, lightweight Git service written in Go (cpe:2.3:a:gitea:gitea_open_source_git_server). It ships a dedicated 'migration HTTP transport' (services/migrations.NewMigrationHTTPTransport) whose purpose is to constrain outbound requests made on behalf of user-configured migrations/mirrors - for example enforcing allowed/blocked host and private-address restrictions that mitigate server-side request forgery. The root cause is CWE-284 (Improper Access Control): in services/mirror/mirror_pull.go (runSync) and services/mirror/mirror_push.go (runPushSync), the Git LFS client was created with a nil transport rather than the migration transport, so LFS object push and sync-mirror fetches did not inherit those protections. The fix (PRs #36665 and #36691) simply passes migrations.NewMigrationHTTPTransport() into lfs.NewClient for both code paths.

RemediationAI

Vendor-released patch: upgrade to Gitea 1.25.5 or later (https://github.com/go-gitea/gitea/releases/tag/v1.25.5), which routes LFS push and sync-mirror requests through the migration HTTP transport via PRs https://github.com/go-gitea/gitea/pull/36665 and https://github.com/go-gitea/gitea/pull/36691. If immediate upgrade is not possible, reduce exposure by restricting who can create or configure repository mirrors (limit mirror/migration privileges to trusted admins) and, at the network layer, place the Gitea server behind egress firewall rules that deny outbound connections to internal/private ranges and cloud metadata endpoints (e.g. 169.254.169.254, RFC1918 ranges) so bypassed LFS requests cannot reach sensitive internal targets; the trade-off is that legitimate mirrors to internal Git/LFS hosts on those ranges will also be blocked. Review the ALLOWED_HOST_LIST / BLOCKED_HOST_LIST migration settings, but be aware that pre-patch these do not fully cover the LFS path, so network egress control is the more reliable stopgap.