CVE-2026-26292 | Gitea versions before 1.25.5 do not use the migration HTTP t…

Description

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

Metadata

CVE ID: CVE-2026-26292
State: PUBLISHED
Assigner: Gitea
Reserved: 2026-02-22 15:13 UTC
Published: 2026-07-03 20:19 UTC
Last updated: 2026-07-03 20:19 UTC
Primary CWE: CWE-284
CWE-284
Vendor / Product: Gitea / Gitea Open Source Git Server
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
Gitea	Gitea Open Source Git Server	—	0 < 1.25.5

Weakness (CWE)

CWE	Source	Description
CWE-284	cna	CWE-284

References (4)

GitHub Pull Request #36665 https://github.com/go-gitea/gitea/pull/36665
GitHub Pull Request #36691 https://github.com/go-gitea/gitea/pull/36691
Gitea v1.25.5 Release https://github.com/go-gitea/gitea/releases/tag/v1.25.5
Gitea v1.25.5 Release Blog Post https://blog.gitea.com/release-of-1.25.5/