CVE-2026-26292

CriticalCVSS 9.8

Published: 03/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

38th percentile - higher than 38% of all known CVEs

Summary

The vulnerability in Gitea before version 1.25.5 is that LFS push and sync mirror operations do not use the migration HTTP transport, bypassing the configured migration transport protections for those LFS requests.

Risk Assessment

The organization may be exposed to unauthorized LFS data transfer outside allowed migration channels, increasing the risk of data leakage or security policy violation.

Recommendation

Immediately upgrade Gitea to version 1.25.5 or later to ensure migration transport protections are applied to all LFS operations.

Original NVD description (English source)

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.