Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a repository, which includes repositories they create themselves, could aim push mirror synchronization at internal Git services and force-push the repository's contents to them.
References
| Link | Resource |
|---|---|
| https://blog.gitea.com/release-of-28.0.0/ | Release Notes |
| https://github.com/go-gitea/gitea/pull/39010 | Patch Issue Tracking |
| https://github.com/go-gitea/gitea/pull/39426 | Patch Issue Tracking |
| https://github.com/go-gitea/gitea/releases/tag/v28.0.0 | Release Notes |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-hcgw-r9gf-8mph | Vendor Advisory |
Configurations
History
13 Oct 2026, 16:46
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:* | |
| First Time |
Gitea gitea
Gitea |
|
| References | () https://blog.gitea.com/release-of-28.0.0/ - Release Notes | |
| References | () https://github.com/go-gitea/gitea/pull/39010 - Patch, Issue Tracking | |
| References | () https://github.com/go-gitea/gitea/pull/39426 - Patch, Issue Tracking | |
| References | () https://github.com/go-gitea/gitea/releases/tag/v28.0.0 - Release Notes | |
| References | () https://github.com/go-gitea/gitea/security/advisories/GHSA-hcgw-r9gf-8mph - Vendor Advisory |
07 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
06 Oct 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 20:17
Updated : 2026-10-13 16:46
NVD link : CVE-2026-89430
Mitre link : CVE-2026-89430
CVE.ORG link : CVE-2026-89430
JSON object : View
Products Affected
gitea
- gitea