CVE-2026-86684 Gitea CVE debrief

Who should care

Gitea instance administrators, repository administrators, developers using Gitea, and security teams responsible for vulnerability management should be aware of this issue. They should assess their exposure, especially if `[security] IMPORT_LOCAL_PATHS = true` is enabled, and take appropriate remediation steps to prevent unauthorized modifications.

Why it matters

Gitea push mirror API vulnerability allows repository administrators to add push mirrors to local paths, potentially pushing refs into existing Git repositories, requiring verification and remediation.

• Potential unauthorized pushing of refs into existing Git repositories.
• Possible exploitation by repository administrators with specific permissions.
• Requires verification of Gitea instance configuration and repository permissions.
• Remediation priority for instances with `[security] IMPORT_LOCAL_PATHS = true`.

Technical summary

The Gitea push mirror API checks repository owner permissions instead of requesting user permissions. This flaw allows a repository administrator to add a push mirror to a local path when the repository owner has that permission, potentially pushing refs into an existing Git repository at that path. The vulnerability is particularly concerning for Gitea instances with `[security] IMPORT_LOCAL_PATHS = true` enabled, as it could lead to unauthorized modifications of Git repositories on the server's file system. Instance administrators and developers should assess exposure and prioritize remediation.

Defensive priority

Repository administrators and Gitea instance maintainers should verify exposure and prioritize remediation.

Recommended defensive actions

• Verify Gitea instance configuration and repository permissions.
• Update to version 28.1.0 or later.
• Review and restrict push mirror configurations.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. Evidence is limited to public sources and may not cover all potential impacts or affected configurations. Defenders should verify Gitea instance configurations, especially where `[security] IMPORT_LOCAL_PATHS = true`, and review repository permissions for potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.