Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-97208 Details

Description

The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://blog.gitea.com/release-of-28.1.0/	Gitea Limited
https://github.com/go-gitea/gitea/pull/39501	Gitea Limited
https://github.com/go-gitea/gitea/pull/39507	Gitea Limited
https://github.com/go-gitea/gitea/releases/tag/v28.1.0	Gitea Limited
https://github.com/go-gitea/gitea/security/advisories/GHSA-8hhh-mqpg-jpxc	Gitea Limited

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-863	Incorrect Authorization	Gitea Limited

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes