{"id":"CVE-2026-89430","published":"2026-10-06T20:17:34.297","lastModified":"2026-10-07T21:17:21.197","description":"Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a repository, which includes repositories they create themselves, could aim push mirror synchronization at internal Git services and force-push the repository's contents to them.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-367","CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39010","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39426","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hcgw-r9gf-8mph","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39010","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39426","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hcgw-r9gf-8mph","tags":[]}],"hasPoc":true,"ai":{"summary":"Gitea allows administrators to set up push mirrors that initially validate remote addresses against allow/block lists, but subsequent synchronizations use the stored address without re-validation, potentially allowing pushes to internal/protected Git services. This creates a privilege escalation vector where users can force-push repository contents to arbitrary internal repositories.","exploitability":"Moderately difficult to exploit; requires an administrator-level account with repository push mirror configuration access, and the ability to configure a mirror that initially passes validation but later resolves to a blocked address.","blast_radius":"Affects all Gitea instances where administrators can configure push mirrors, potentially allowing attackers to overwrite internal repositories with malicious content or gain persistence through forced pushes to critical internal Git services.","remediation":"Upgrade to Gitea 2.590 or later to receive the fix for CVE-2026-89430.","detection":"Monitor for repository push mirror configuration changes in Gitea logs, specifically looking for 'mirror' or 'push' operations that modify mirror URLs without re-validation against migration allow/block lists. No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","config-management","git"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:58:04.881Z"}}