BIT-GITEA-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

BIT-GITEA-2026-86684 Gitea push mirror local path check uses the repository owner

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684

A flaw was found in Gitea. An improper authorization check in the push mirror API allows an authenticated repository administrator to bypass local file system access restrictions. When a repository owner has permission to use local paths, an administrator lacking that privilege can configure a pu...

CVE-2026-86684

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-86684

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with "security IMPORTLOCALPATHS = true", a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684 Gitea push mirror local path check uses the repository owner

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684 Gitea push mirror local path check uses the repository owner

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

EUVD-2026-94051

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684

An improper authorization check in the Gitea push mirror API allows an authenticated repository administrator to bypass local file system access restrictions. When the [security] IMPORT_LOCAL_PATHS = true setting is enabled, an administrator who lacks permission to import local paths can configur...

CVE-2026-86684

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684: Incorrect Authorization

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

PT-2026-107289

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The push mirror API incorrectly validates permissions by checking if the repository owner, rather than the requesting user, is authorized to use local file system paths. On instances where the...