CVE-2026-26292
published 2026-07-03CVE-2026-26292: Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport…
PriorityP355critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.48%
39.8th percentile
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitea | gitea_open_source_git_server | < 1.25.5 | 1.25.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Gitea up to 1.25.4 access control
vuldb·2026-07-04
CVE-2026-26292 [CRITICAL] Gitea up to 1.25.4 access control
A vulnerability identified as critical has been detected in Gitea up to 1.25.4. This issue affects some unknown processing. The manipulation leads to improper access controls.
This vulnerability is traded as CVE-2026-26292. It is possible to initiate the attack remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
ghsa_unreviewed·2026-07-03
CVE-2026-26292 CWE-284 Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-03
Published