VulnSocial

CVE-2026-89430(gitea / gitea)

LOWCVSS 8.1 · HIGH

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a repository, which includes repositories they create themselves, could aim push mirror synchronization at internal Git services and force-push the repository's contents to them.

gitea CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-367CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gitea

Affected systems

Vendors
gitea
Products
gitea

Deep dive

Full discourse1 post
  • iototsecnews@iototsecnews

    Gitea の 27件の脆弱性が FIX：深刻な SSH 認証バイパスや SSRF の恐れ https://iototsecnews.jp/2026/10/08/gitea-patches-27-security-flaws-including-critical-ssh-authentication-bypass-and-ssrf/ Gitea 製コード管理プラットフォームにおける深刻な欠陥 CVE-2026-103059 について解説する記事です。認証処理の不備や検証機能の欠落に伴い、他者への成りすまし／内部ネットワークへの不正アクセス／承認回避によるプログラム実行といった不具合が生じる危険性があります。対象となる CVE は CVE-2026-103059／CVE-2026-70357／CVE-2026-101027／CVE-2026-101029／CVE-2026-89430／CVE-2026-104632／CVE-2026-94205 です。対象となる製品は Gitea です。対応策として修正版への更新／ネットワークルールの見直しが求められます。 #Gitea #CVE2026103059 #CVE2026103059 #CVE202670357 #CVE2026101027 #CVE2026101029 #CVE202689430 #CVE2026104632 #CVE202694205

    0100089
    518 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgiteagitea---

Explore more

Back to dashboardgitea CVEsgitea vulnerabilities