Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gitea |
|
No data.
No data.
References
History
Mon, 06 Jul 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Gitea
Gitea gitea Open Source Git Server |
|
| Vendors & Products |
Gitea
Gitea gitea Open Source Git Server |
Fri, 03 Jul 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests. | |
| Title | Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions | |
| Weaknesses | CWE-284 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Gitea
Published: 2026-07-03T20:19:35.166Z
Updated: 2026-07-03T20:19:35.166Z
Reserved: 2026-02-22T15:13:33.694Z
Link: CVE-2026-26292
Vulnrichment
No data.
NVD
No data.
Redhat
No data.