Incorrect authorization in Gitea - CVE-2026-86684
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote user to write controlled Git refs and repository content to a local Git repository outside the intended authorization boundary and infer whether candidate local paths pass directory validation.
The vulnerability exists due to incorrect authorization in Gitea's push-mirror API when checking local-path permissions against the repository owner instead of the caller. A remote user can use repository-admin access to submit an absolute file:// path through the remote_address parameter of POST /api/v1/repos/{owner}/{repo}/push_mirrors and trigger synchronization to write controlled Git content to a target repository writable by the Gitea process; differing validation responses can also reveal limited information about local directory existence.