CVE-2026-86684

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86684

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	From 1.18.0 (inc) to 28.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea involves the push mirror API incorrectly checking permissions. When a server has IMPORT_LOCAL_PATHS enabled, a repository administrator without local path access could add a push mirror to a local server path if the repository owner has that permission. Gitea then pushes repository refs to that path using the Gitea process permissions.

Detection Guidance

Check Gitea configuration files for `[security] IMPORT_LOCAL_PATHS = true` in the app.ini file. Verify if any repository administrators have added push mirrors to local file system paths by inspecting repository settings and mirror configurations.

Impact Analysis

An attacker with repository administrator access could potentially write files to arbitrary local paths on the server with the permissions of the Gitea process. This could lead to unauthorized file access, data leakage, or system compromise depending on the server's configuration.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data stored on the server. It may lead to data breaches, unauthorized modifications, or exposure of regulated information, potentially resulting in legal penalties under standards like GDPR or HIPAA.

Mitigation Strategies

Set `[security] IMPORT_LOCAL_PATHS = false` in Gitea's configuration file to disable local path imports. Ensure repository administrators do not have unnecessary permissions that could allow local path access.

Hi! I’m here to help you understand CVE-2026-86684. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70