Read the docs
TI-2026-68962 Aliases CVE-2026-86684

Incorrect authorization in Gitea push mirror local path check

Priority LOW 32CWE-863Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-863.

Summary

Gitea from 1.18.0 through 28.0.0 checks the repository owner instead of the requesting user before allowing push mirrors to local paths. This incorrect authorization flaw (CWE-863) lets a repository administrator without local path import rights add a push mirror to a local path when the owner has that right. Gitea then pushes refs into the existing Git repository at that path with the Gitea process permissions. The references include an exploit link.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00146 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GiteaGitea1.18.0 – 28.0.0—No fix listedCNA
  • Gitea VendorGitea Affected 1.18.0 – 28.0.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*1.18.0 to before 28.1.0VulnerableGitea
  • cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:* Versions 1.18.0 to before 28.1.0 Vulnerable ·Gitea

Remediation

The sources list no fixed version for Gitea.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-86684
  2. 2026-10-07 CVSS score added · CISA ADP
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-08 Affected versions changed · Red Hat
  5. 2026-10-08 CVSS score added · Red Hat

References

Exploit 1

Patch 2

Other 2

  • TI-2026-42785 Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-11072 The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote… CVSS 3.1HIGH 7.2
  • TI-2022-12910 Gitea before 1.16.7 does not escape git fetch remote. CVSS 3.1HIGH 7.5
  • TI-2019-08404 models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror… CVSS 3.1HIGH 8.8
  • TI-2022-00955 Open Redirect on login in go-gitea/gitea CVSS 3.1MEDIUM 6.1
  • TI-2026-68968 Push-to-create bypass of FORCE_PRIVATE policy in Gitea CVSS 3.1MEDIUM 5.4
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences