{"id":"EUVD-2026-41630","enisaUuid":"43b3eb8d-10da-39fc-bc43-1abc81dcf85d","description":"Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.","datePublished":"Jul 3, 2026, 8:19:35 PM","dateUpdated":"Jul 7, 2026, 4:59:11 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/go-gitea/gitea/pull/36665\nhttps://github.com/go-gitea/gitea/pull/36691\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","aliases":"CVE-2026-26292\nGHSA-rc56-rj3f-xggf\n","assigner":"Gitea","epss":0.65,"enisaIdProduct":[{"id":"be695ae8-8ed4-38ed-b4e2-dc92b037216e","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"enisaIdVendor":[{"id":"dfee77fa-382c-3084-8a16-7ed8f066f7a5","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"7d1b1ff6-dc90-33a4-9d9c-8f943579dfd4","vulnerability":{"id":"GHSA-rc56-rj3f-xggf","description":"Gitea LFS mirror operations bypass migration HTTP transport protections","datePublished":"Jul 3, 2026, 9:31:37 PM","dateUpdated":"Sep 1, 2026, 5:21:47 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-26292\nhttps://github.com/go-gitea/gitea/pull/36665\nhttps://github.com/go-gitea/gitea/pull/36691\nhttps://github.com/go-gitea/gitea/commit/996cc12bf7d54ae2326f20b4211fff70eb31e74a\nhttps://github.com/go-gitea/gitea/commit/bcd253a310115045d3ec5e8168a953fbee34dd28\nhttps://blog.gitea.com/release-of-1.25.5\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\n","enisa_id":"EUVD-2026-41630\n","aliases":"CVE-2026-26292\nGHSA-rc56-rj3f-xggf\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a213cfd8-5145-397a-8a15-68f0d43174d8","vulnerability":{"id":"CVE-2026-26292","description":"Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.","datePublished":"Jul 3, 2026, 8:19:35 PM","dateUpdated":"Jul 7, 2026, 4:59:11 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/go-gitea/gitea/pull/36665\nhttps://github.com/go-gitea/gitea/pull/36691\nhttps://github.com/go-gitea/gitea/releases/tag/v1.25.5\nhttps://blog.gitea.com/release-of-1.25.5/\n","enisa_id":"EUVD-2026-41630\n","assigner":"Gitea","epss":0.65,"dataProcessed":"Oct 29, 2026, 7:19:33 AM","vulnerabilityProduct":[{"id":"b1bdd265-a864-3da3-addd-fa292310681e","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.25.5"}],"vulnerabilityVendor":[{"id":"0af742da-2cc9-3d43-b1ba-6ca49836f3bd","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}