CVE-2026-86684

The Gitea push mirror API contains an incorrect authorization flaw where it validates local file system path permissions against the repository owner instead of the requesting user. On instances where [security] IMPORT_LOCAL_PATHS = true, a repository administrator lacking local path import privi...