CVE-2026-86684

The Gitea push mirror API contains an incorrect authorization flaw where it validates local file system path permissions against the repository owner instead of the requesting user. On instances where [security] IMPORT_LOCAL_PATHS = true, a repository administrator lacking local path import privi...

CVE-2026-89430

The Gitea push mirror functionality contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) and a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). The software only validates a push mirror's remote address against [migrations] allow and block lists during creation. Durin...