The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.
References
| Link | Resource |
|---|---|
| https://blog.gitea.com/release-of-28.1.0/ | Release Notes |
| https://github.com/go-gitea/gitea/pull/39501 | Patch Issue Tracking |
| https://github.com/go-gitea/gitea/pull/39507 | Patch Issue Tracking |
| https://github.com/go-gitea/gitea/releases/tag/v28.1.0 | Release Notes |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-7v5j-mph8-9w6g | Exploit Mitigation Vendor Advisory |
Configurations
History
13 Oct 2026, 18:05
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:* | |
| References | () https://blog.gitea.com/release-of-28.1.0/ - Release Notes | |
| References | () https://github.com/go-gitea/gitea/pull/39501 - Patch, Issue Tracking | |
| References | () https://github.com/go-gitea/gitea/pull/39507 - Patch, Issue Tracking | |
| References | () https://github.com/go-gitea/gitea/releases/tag/v28.1.0 - Release Notes | |
| References | () https://github.com/go-gitea/gitea/security/advisories/GHSA-7v5j-mph8-9w6g - Exploit, Mitigation, Vendor Advisory | |
| First Time |
Gitea gitea
Gitea |
07 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
06 Oct 2026, 22:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 22:17
Updated : 2026-10-13 18:05
NVD link : CVE-2026-86684
Mitre link : CVE-2026-86684
CVE.ORG link : CVE-2026-86684
JSON object : View
Products Affected
gitea
- gitea
CWE
CWE-863
Incorrect Authorization