GO-2026-6344 Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea

Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the LFS mirror synchronization process. An attacker can bypass configured HTTP transport restrictions by initiating LFS push or sync mirror operations, allowing unauthorized network requests to be made outside o...

Gitea LFS mirror operations bypass migration HTTP transport protections

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests...

GHSA-RC56-RJ3F-XGGF Gitea LFS mirror operations bypass migration HTTP transport protections

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests...