Vulnerability Intelligence Report
Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
CVE-2026-26292
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:0.48%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-284 ↗CWE-284
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Gitea | Gitea Open Source Git Server | 0 < 1.25.5 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.482%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Gitea Limited · Open Source · China |
| Reserved | 2026-02-22T15:13:33 |
| Published | 2026-07-03T20:19:35 |
| Last Updated | 2026-07-07T16:59:11 |
Community Chatter & Buzz