Gitea CVE-2026-26292

Exploitation requires the ability to configure a repository push mirror or pull/sync mirror in Gitea and to control the associated LFS endpoint, so that the vulnerable code paths (runPushSync in mirror_push.go, runSync in mirror_pull.go) are exercised; the flaw only manifests for Git LFS push and sync-mirror requests, not for the general migration HTTP transport which was already protected. Limiting factors: the target instance must be running a version before 1.25.5, mirroring/migration functionality must be enabled, and the actor must reach the mirror-configuration workflow - which in default deployments is an authenticated, repository-privileged action rather than fully anonymous access, tempering the published PR:N assumption.

The signals conflict and warrant caution. The published CVSS 3.1 vector is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), but the vulnerability is an access-control/transport-restriction bypass affecting LFS traffic during mirror operations - configuring a push or sync mirror in Gitea normally requires an authenticated user with repository admin rights, so PR:N appears optimistic and the C:H/I:H/A:H 'total' impact likely reflects SSRF-style reachability of internal resources rather than direct remote code execution. SSVC aligns partially: Exploitation=none (no observed activity), Automatable=yes, Technical Impact=total, and EPSS is low at 0.17% (7th percentile), indicating no evidence of widespread exploitation. This is a real defense-in-depth regression worth patching - especially for instances that rely on migration allowlists to prevent SSRF into internal networks - but the 9.8 rating probably overstates real-world unauthenticated risk; the practical prerequisite of mirror-configuration access should be verified against your deployment.

An authenticated user with rights to set up a repository push or sync mirror points the LFS endpoint at an internal address that the migration transport allowlist would normally block. Because the LFS client ran without the migration transport, Gitea issues the LFS request to that internal target on the attacker's behalf, enabling SSRF-style reach into the server's internal network. No public exploit code has been identified, and the network attack complexity is low.