CVE-2026-97208 Gitea CVE debrief

Who should care

Gitea instance administrators, repository administrators, and security teams responsible for monitoring and enforcing security policies on Gitea instances should be aware of this vulnerability. They need to verify their Gitea instance configurations to ensure that the DISABLE_NEW_PUSH policy is properly enforced and review repository administrator roles and permissions. Additionally, they should monitor Gitea instances for suspicious push mirror activity.

Why it matters

The CVE-2026-97208 vulnerability in Gitea's push mirror API could allow repository administrators to bypass the DISABLE_NEW_PUSH policy set by site administrators, potentially leading to unintended repository ref pushing.

• Repository administrators could create new push mirrors despite site administrators disabling them
• Potential for unintended pushing of repository refs to remote locations
• Need for verification of Gitea instance configurations and repository administrator roles

Technical summary

The Gitea API endpoint for creating push mirrors did not check the DISABLE_NEW_PUSH setting, allowing repository administrators to create new push mirrors even when site administrators had disabled them. This vulnerability arises from the API's inadequate validation of the DISABLE_NEW_PUSH policy, which is a critical security control. The technical issue lies in the API's failure to enforce this policy, potentially leading to unauthorized pushing of repository refs to remote locations. Affected Gitea instances should be updated to enforce this policy properly.

Defensive priority

Repository administrators and site administrators should verify their Gitea instance configurations to ensure that the DISABLE_NEW_PUSH policy is properly enforced.

Recommended defensive actions

• Verify Gitea instance configurations to ensure DISABLE_NEW_PUSH policy is enforced
• Review repository administrator roles and permissions
• Monitor Gitea instance for suspicious push mirror activity
• Perform a thorough review of existing push mirrors to identify potential unauthorized configurations
• Implement additional logging and monitoring for push mirror activities
• Conduct regular security audits of Gitea instance configurations
• Ensure that repository administrators are aware of the DISABLE_NEW_PUSH policy and its implications

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. The Gitea API's push mirror creation endpoint did not validate the DISABLE_NEW_PUSH policy, which is a critical security setting. This oversight allows repository administrators to create push mirrors even when the site administrator has disabled this feature. Evidence from the CVE record and source item confirms this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.