CVE-2026-26292 Gitea CVE debrief

Who should care

Users and administrators of Gitea instances, especially those using versions before 1.25.5, should be aware of this vulnerability. Given the critical nature of this vulnerability, immediate attention is required to ensure the security of Gitea installations.

Technical summary

The vulnerability is caused by Gitea's failure to utilize the migration HTTP transport for Large File Storage (LFS) push and sync mirror operations. This oversight allows LFS requests to bypass the protections configured for migration transports. The issue affects Gitea versions prior to 1.25.5. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 9.8, indicating a high severity level. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which signifies that the vulnerability can be exploited remotely without authentication, leading to high impacts on confidentiality, integrity, and availability.

Defensive priority

High

Recommended defensive actions

• Upgrade Gitea to version 1.25.5 or later to mitigate the vulnerability.
• Review and adjust the migration transport configurations to ensure they are applied correctly for LFS operations.
• Monitor Gitea instances for any suspicious LFS push and sync mirror operations.
• Implement additional security measures such as restricting access to Gitea instances and enhancing network monitoring.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-03T21:16:58.517Z and was last modified on 2026-07-07T18:16:37.470Z. The NVD entry is currently Deferred. References include the official Gitea release notes for version 1.25.5, as well as pull requests and release tags related to the fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.