CVE-2026-97208

The Gitea API endpoint for creating push mirrors (POST /api/v1/repos/{owner}/{repo}/push_mirrors) contains a logic flaw where it fails to enforce the [mirror] DISABLE_NEW_PUSH policy. While the web interface respects this restriction, the API only verifies if mirroring is enabled. This allows a r...