Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-26292

Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions

Description

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Gitea Gitea Open Source Git Server

Default version status: unaffected

  • 0 to < 1.25.5affected

References