CVE-2026-86684
Gitea: incorrect authorisation
- Risk score
- 48/100
- CVSS
- 7.1 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with [security] IMPORT_LOCAL_PATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the rep…
- Affected
- Gitea
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…
The flaws
- CVE-2026-86684: Incorrect authorisation (CVSS 7.1 · EPSS 0%)
- CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
- CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
- CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Gitea
Where it stands
- Exploited in the wild
- On CISA's exploited list since 25 Aug
- US federal deadline 28 Aug
How it unfolded
- 25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
- 28 Aug, Deadline (official): US federal agencies must have patched
Connects to
- Same weakness: Incorrect authorisation (CWE-863). 335 other warnings in 30 days
- Same product: Earlier Gitea warnings. 25 in the last 90 days
Why it is Yellow
- CVSS 7.1 high
- Public exploit or proof of concept referenced
References
Original description
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.
Last activity 6 Oct 2026. Patch Forecast updates every hour.