CVE-2026-26292 affects Gitea Open Source Git Server versions before 1.25.5. The issue arises because LFS push and sync mirror operations do not utilize the migration HTTP transport, which is intended to enforce migration transport protections. As a result, these LFS requests bypass the configured access controls, leading to improper access control (CWE-284). This vulnerability has a critical severity rating with a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability.

The vulnerability allows LFS push and sync mirror operations to circumvent the migration transport protections configured in Gitea. This can lead to unauthorized access or modification of repository data, potentially compromising confidentiality, integrity, and availability of the affected Git server. The critical CVSS score reflects the potential for remote exploitation without authentication and with low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor Gitea's official channels for updates addressing this vulnerability. Until a patch is available, consider restricting LFS push and sync mirror operations or applying additional access controls at the network or application level to mitigate risk.