What is GHSA-rc56-rj3f-xggf?

GHSA-rc56-rj3f-xggf is a security advisory published by GitHub Security Advisories with unknown severity. Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror...

Which CVE IDs does GHSA-rc56-rj3f-xggf cover?

GHSA-rc56-rj3f-xggf covers the following CVE IDs: CVE-2026-26292. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-rc56-rj3f-xggfunknown

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror...

Vendor

GitHub Security Advisories

Published

July 3, 2026

Last Modified

July 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-26292 →

📋 Description

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-26292
https://github.com/go-gitea/gitea/pull/36665
https://github.com/go-gitea/gitea/pull/36691
https://blog.gitea.com/release-of-1.25.5
https://github.com/go-gitea/gitea/releases/tag/v1.25.5
https://github.com/advisories/GHSA-rc56-rj3f-xggf