All vulnerabilities
CVE-2026-97208GHSA-8hhh-mqpg-jpxc

Gitea push mirror API bypass of DISABLE_NEW_PUSH policy

Gitea Gitea
Open in ThreatlineRecord JSON
CVSS
4.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in28.1.0Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 28.1.0gitea.dev, goGitHubgo get gitea.dev@v28.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Gitea API endpoint for creating push mirrors (POST /api/v1/repos/{owner}/{repo}/push_mirrors) checked only whether mirroring was enabled and not the [mirror] DISABLE_NEW_PUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule.

Text from CVE List

Affected versions 2

  • Giteaaffected: all versions through 28.0.0CVE List
  • gitea.dev, go<= 28.0.0GitHub

References 5