CVE-2026-26292: Gitea Package Vulnerability in LFS Mirror Operations Bypassing Migration Protections
Summary
CVE-2026-26292: Gitea LFS mirror operations bypass migration HTTP transport protections. Affects code.gitea.io/gitea versions < 1.25.5. Fixed in 1.25.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is a self-hosted Git service that provides a lightweight and easy-to-use platform for managing Git repositories. It includes features such as issue tracking, pull requests, and a built-in wiki. The package is widely used for its simplicity and efficiency in handling Git operations. However, certain versions of Gitea prior to 1.25.5 are vulnerable to a critical issue that affects its handling of Large File Storage (LFS) operations, specifically during push and sync mirror actions.
Vulnerability Detail
The vulnerability arises from Gitea's failure to utilize the migration HTTP transport for LFS push and sync mirror operations in versions before 1.25.5. This oversight allows attackers to bypass the configured migration transport protections, potentially leading to unauthorized access and manipulation of sensitive data. The ramifications of this vulnerability are severe, as it could allow malicious actors to exploit the LFS functionality to compromise the integrity and confidentiality of the repositories.
How To Fix
Latest published version: v1.26.4 as of 22 Oct 2026
go get code.gitea.io/gitea@v1.26.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.25.5
This is the first release that contains the fix.
go get code.gitea.io/gitea@v1.25.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable LFS functionality until the package is updated. This can be done by modifying the configuration file to set the LFS feature to false. Example configuration: LFS = false.
Conclusion
In summary, CVE-2026-26292 represents a critical vulnerability in Gitea that allows LFS operations to bypass important security protections. Users are strongly advised to update to version 1.25.5 or later to mitigate this risk. Additionally, temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for code.gitea.io/gitea →
FAQ
CVE-2026-26292 is a critical vulnerability in Gitea that allows LFS mirror operations to bypass migration HTTP transport protections.
Gitea versions prior to 1.25.5 are affected by this vulnerability.
The vulnerability can lead to unauthorized access and manipulation of sensitive data within repositories.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for code.gitea.io/gitea.
