CVE-2026-97208

Received Received - Intake

Push Mirror Creation Bypasses Admin Disable in Gitea

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: Gitea Limited

Description

The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-06

Generated

2026-10-07

AI Q&A

2026-10-07

EPSS Evaluated

N/A

NVD

CVE-2026-97208

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Gitea API endpoint for creating push mirrors. The endpoint only verified if mirroring was enabled but ignored the [mirror] DISABLE_NEW_PUSH setting enforced by the web interface. This allowed repository administrators to create new push mirrors even when site administrators had disabled them. A push mirror automatically pushes all repository refs to a remote location chosen by the user on each commit or schedule.

Impact Analysis

If you are a site administrator, an attacker with repository admin access could bypass your restrictions and create unauthorized push mirrors. This could lead to unintended data exposure or leakage of repository contents to external systems. If you are a user, your repository data might be pushed to unauthorized locations without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized data transfers, potentially violating data protection regulations like GDPR or HIPAA. If repository data is pushed to unapproved external systems, it may result in non-compliance with data residency or security requirements. Organizations must ensure repository data is only mirrored to approved locations to maintain compliance.

Mitigation Strategies

Update Gitea to the latest version where this issue is fixed. Review repository settings to ensure no unauthorized push mirrors exist. Check logs for suspicious mirror creation attempts.

Hi! I’m here to help you understand CVE-2026-97208. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70