CVE-2026-86684

Executive Summary

CVE-2026-86684 is an authorization logic flaw in Gitea's push mirror API that validates the repository owner's local-path import permission rather than the requesting user's permission. On instances configured with [security] IMPORT_LOCAL_PATHS = true, a repository administrator lacking local-path privileges can create a push mirror pointing to a server-local Git repository when the repository owner does hold that permission. Gitea then writes the repository's refs into the target path using the privileges of the Gitea process, enabling unauthorized modification of server-side repositories.

Technical Analysis

The vulnerability is an instance of CWE-863 (Incorrect Authorization). The affected component is the Gitea push mirror API. The following details are explicitly supported by the NVD description; no additional implementation specifics are asserted here because they are not provided.

• Authorization subject confusion: The push mirror API "checked whether the repository owner, instead of the requesting user, may use local file system paths." The permission check is performed against the wrong principal. Where authorization decisions are bound to an attribute of a different object (here, the owner) rather than the actual actor (the requesting repository administrator), an actor with lower privilege inherits the target object's entitlements. This is a classic confused-deputy pattern: the Gitea process, which holds filesystem write access, acts on behalf of a requester who is not entitled to that capability.

• Preconditions: The flaw is only exploitable when the instance profile sets [security] IMPORT_LOCAL_PATHS = true. This setting permits repositories to reference local filesystem paths. Two distinct privilege states must diverge for abuse to succeed: the requesting repository administrator must lack local-path import permission, while the repository owner must possess it. The attack therefore requires an authenticated account with repository-administration rights on a repository whose owner has the local-path entitlement.

• Attack surface: The push mirror API is the sole interface identified in the description. Push mirrors replicate a Gitea repository's refs to a configured remote; here the remote is a "local path on the server." Because the mirror source is the server's own filesystem rather than a network endpoint, the authorized actor's reach is server-local.

• Impact mechanism: "Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process." The write is executed under the Gitea process identity, not the requester's identity. Any repository existing at the targeted path may have its refs overwritten or injected with attacker-controlled content. The description states the target must be an "existing Git repository," so the exploit is a write into an existing server-side repository rather than creation of an arbitrary path.

The core technical defect is thus a missing equality check between "requesting user permission" and "owner permission" at the push-mirror creation/validation boundary. No specific function names, classes, routes, or parameter names are present in the supplied description; they are intentionally omitted rather than fabricated.

Exploitation Scenarios

No public PoC or exploit code is available (PoC/Exploit: None). The following chain is inferred strictly from the vulnerability class and the mechanics stated in the NVD description. No implementation-specific names are invented.

1. Reconnaissance / target identification An attacker with an authenticated Gitea account obtains repository-administration rights on at least one repository. They identify a repository whose owner holds local-path import privileges (for example an owner account used for instance administration or a service account with elevated entitlements). They also confirm the instance advertises or is known to run with [security] IMPORT_LOCAL_PATHS = true; this is a configuration prerequisite, not a remotely discoverable banner, so it may require prior knowledge, insider access, or inference from instance behavior.

2. Triggering the authorization flaw The attacker invokes the push mirror creation/update path for the repository they administer, specifying a server-local filesystem path as the mirror target. Because the backend evaluates the repository owner's permission instead of the requesting user's permission, the check passes even though the attacker personally lacks local-path permission. The incorrect-subject authorization decision is the vulnerability-class trigger: a permission gate keyed to the wrong principal.

3. Execution at the vulnerability-class level On acceptance, Gitea performs the mirror push. It reads the administering repository's refs and writes them into the existing local Git repository at the specified path. This write occurs with the privileges of the Gitea process. The attacker does not need to supply a memory-corruption payload, a script, or a crafted file format; the "payload" is the content of the repository under their control (its refs and commits).

4. Post-exploitation impact The refs of a server-side Git repository are overwritten or injected with attacker-controlled commits. Depending on which local repository was targeted, this can corrupt source integrity, inject code into a repository that later feeds a build or deployment pipeline, overwrite deployment configuration stored in Git, or tamper with a repository that other users trust. Because the write is local and process-privileged, standard network egress controls do not observe it, and the operation appears in Gitea as a legitimate mirror push.

Constraint: exploitation requires authentication, administrative rights on a repository, a divergent permission state between requester and owner, and the IMPORT_LOCAL_PATHS configuration to be enabled. No remote unauthenticated path is described.

Impact Assessment

• Confidentiality: Not indicated by the description. The flaw describes a write into a local repository; no read or disclosure of files is asserted.
• Integrity: Primary impact. "Pushed the repository's refs into an existing Git repository" means attacker-influenced Git object content results in an existing server-side repository, with the write performed under the Gitea process identity.
• Availability: Not directly asserted. Ref overwrites in a targeted repository can disrupt services that consume that repository, but this is consequential, not stated as a direct effect.
• Scope: Local to the Gitea host. The affected file is on the server's filesystem; no cross-instance or network-remote effect is described.
• Privilege requirement: An authenticated principal with repository administration on a repository whose owner has the local-path permission. The vulnerability is an authorization bypass that elevates that administrator's effective capability to that of the Gitea process for the mirror target.

Blast radius is bounded by the set of server-local Git repositories writable by the Gitea process and reachable as mirror targets. In environments where Gitea hosts canonical source or deployment/configuration repositories, the integrity impact can propagate into CI/CD and release processes downstream of the tampered repository.

No CVSS score, vector, or EPSS value is provided by the source data. The CVSS vector shown in METADATA is an analyst-applied estimate reflecting a network-reachable, high-privilege, no-user-interaction authorization bypass with integrity-only impact; it is not vendor-assigned and must not be treated as authoritative. FIRST.org has not yet scored EPSS. CVE-2026-86684 is not listed in CISA KEV.

Detection Guidance

Detection focuses on push-mirror activity that references server-local filesystem paths and on authorization-state divergence between the requesting user and the repository owner. Because no patch or exploit telemetry exists, detections should prioritize anomalous mirror-configuration changes and IMPORT_LOCAL_PATHS-adjacent events.

Sigma Rule

title: Gitea Push Mirror Configured with Local Filesystem Path
id: 6f2c1a90-4b7e-4d2a-9c31-8a5e0d7b3f11
status: experimental
description: Detects creation or modification of a Gitea push mirror whose remote address is a server-local filesystem path, consistent with abuse of CVE-2026-86684 (owner-vs-requester authorization confusion).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86684
author: valtersit.com
date: 2026/01/01
logsource:
  product: gitea
  service: audit
detection:
  selection_event:
    action:
      - 'repo.mirror_sync'
      - 'mirror.push.create'
      - 'mirror.push.update'
  selection_local_path:
    address|startswith:
      - '/'
      - 'file:///'
      - './'
      - '../'
  condition: selection_event and selection_local_path
fields:
  - actor
  - repo
  - address
falsepositives:
  - Legitimate administrators intentionally mirroring to local staging paths
level: medium

YARA Rule

rule CVE_2026_86684_Gitea_Local_Path_Mirror
{
    meta:
        author = "valtersit.com"
        description = "Detects Gitea push mirror configuration referencing server-local filesystem paths, associated with CVE-2026-86684 authorization confusion."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86684"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $mirror_push = "MIRROR_PUSH" ascii nocase
        $addr_slash  = "address" ascii nocase
        $root_path   = "/data/git/repositories" ascii nocase
        $home_path   = "/home/git" ascii nocase
        $file_uri    = "file:///" ascii nocase

    condition:
        $mirror_push and $addr_slash and 1 of ($root_path, $home_path, $file_uri)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-86684 Gitea Push Mirror Local Path Configuration Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/mirror"; http.uri; content:"push"; nocase; http.request_body; content:"address"; nocase; http.request_body; pcre:"/\"address\"\s*:\s*\"(\/|file:\/\/\/|\.\.\/)/i"; reference:cve,2026-86684; classtype:attempted-admin; sid:202686684; rev:1;)

Elastic Detection

api.mirror.push create or api.mirror.push update

sequence by user.name with maxspan=5m
  [ any where event.action in ("mirror.push.create", "mirror.push.update") and
      process.name : "gitea" and
      user.name != null ]
  [ any where event.action in ("mirror.push.create", "mirror.push.update") and
      string(user.target) != string(user.name) and
      wildcard(url.path, "*/*") ]

Splunk SPL Query

index=gitea sourcetype="gitea:audit" (action="repo.mirror_sync" OR action="mirror.push.create" OR action="mirror.push.update")
| eval is_local=if(match(address, "^(/|file:///|\.\./)"), 1, 0)
| where is_local=1
| table _time, actor, user, repo, owner, address, action
| sort - _time

Related configuration-drift query:

index=gitea (config OR settings) ("IMPORT_LOCAL_PATHS" OR "security.IMPORT_LOCAL_PATHS")
| stats count by host, user, value

Wazuh OSSEC Rule

<group name="gitea,web,">
  <rule id="100684" level="8">
    <decoded_as>json</decoded_as>
    <field name="action">mirror\.push\.(create|update)</field>
    <field name="address">^(\/|file:///|\.\./)</field>
    <description>CVE-2026-86684: Gitea push mirror configured with a server-local filesystem path</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="100685" level="10">
    <decoded_as>json</decoded_as>
    <field name="action">mirror\.push\.(create|update)</field>
    <field name="address">^(\/|file:///|\.\./)</field>
    <field name="requester_is_owner">false</field>
    <description>CVE-2026-86684: Gitea local-path mirror where requester differs from repository owner</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range is available in the supplied data. The following are configuration and control measures, not vendor-supplied remediation.

1. Immediate mitigations

• Disable the prerequisite: set [security] IMPORT_LOCAL_PATHS = false (or remove it) in the Gitea configuration and restart the service. The vulnerability is only reachable when this option is enabled, so disabling it removes the exposure described in the NVD entry.
• If IMPORT_LOCAL_PATHS = true is operationally required, restrict it to instances where all repository owners and administrators are equally trusted; the flaw specifically abuses divergence between the two permission states.
• Audit existing push mirrors on all repositories and identify any configured with server-local filesystem targets. Remove or correct unauthorized mirror configurations.
• Temporarily reduce the set of accounts holding repository-administration rights, and ensure no non-privileged administrator oversees repositories owned by privileged accounts.

2. Patch / upgrade steps

• No patch or fixed version is identified in the tracked sources. Monitor the Gitea project's release notes and security advisories for a version that adds a requesting-user authorization check to the push mirror path validation. Until a fix is published, treat the instance as unpatched and apply the mitigations above.
• After any future upgrade, re-verify the authorization behavior by confirming that an administrator lacking local-path permission cannot create a mirror referencing a server-local path even when the owner is entitled.

3. Long-term hardening

• Enforce least privilege on repository ownership; do not assign local-path import privileges to any identity that also owns repositories administered by lower-privileged users.
• Operate Gitea under a dedicated, restricted service account whose filesystem write scope is limited to the repositories it must serve, minimizing the reach of any write performed with the process's permissions.
• Centralize and alert on configuration drift for security-relevant settings such as IMPORT_LOCAL_PATHS, and log all mirror configuration changes for audit.
• Apply repository integrity controls (protected refs, branch protection, signed commits, and required review) so that ref overwrites into sensitive repositories are detected and blocked downstream.
• Include server-local mirror targets and unexpected ref changes in continuous integrity monitoring of Gitea-hosted repositories.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86684
• CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
• Gitea project security advisories and release notes: https://github.com/go-gitea/gitea/releases
• Gitea configuration documentation (security.IMPORT_LOCAL_PATHS): https://docs.gitea.com/administration/config-cheat-sheet
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/

Threat actor campaigns and exploit-in-the-wild evidence: none identified. No public PoC or exploit code exists for CVE-2026-86684, and the CVE is not listed in CISA KEV. EPSS has no score from FIRST.org at this time.