CVE-2026-26292: falha crítica em Gitea Open Source Git Server
Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.7%
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Gitea · Gitea Open Source Git ServerCVEs relacionadas — Gitea Open Source Git Server
No mesmo produto, das mais perigosas para as menos.
CVE-2024-6886CRITICALInproper Sanitation of field leading to stored XSSEPSS 33.0%CVE-2026-20896CRITICALGitea Docker image trusts spoofable reverse-proxy headers by defaultEPSS 2.8%CVE-2026-27771HIGHGitea Composer package source links use insufficient permission checksEPSS 1.4%CVE-2026-27775HIGHGitea pre-receive hook permission cache allows full repository write accessEPSS 0.9%CVE-2026-56654CRITICALPrivilege Escalation via Access Token Scope Escalation in APIEPSS 0.8%CVE-2026-27780CRITICALGitea pre-receive hook can miss branch-protection checks after scanner errorsEPSS 0.6%