# CVE-2026-97208: Gitea API push mirror authorization bypass in configuration enforcement

Source: https://junglewise.ai/threats/cve-2026-97208-the-gitea-api-endpoint-for-creating-push-mirrors-post-api-v1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-97208 · Severity: info · Published 2026-10-06

Gitea is a self-hosted Git service that allows site administrators to disable the creation of push mirrors (automated replication of repositories to external destinations). The API endpoint for creating push mirrors failed to enforce this setting, allowing repository administrators to bypass the restriction and create mirrors even when the site administrator had forbidden them. An attacker with repository admin access could use this to exfiltrate code to external systems or cause unauthorized repository synchronization.

Technologies: [Gitea](https://junglewise.ai/threats/technologies/gitea). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea).

## Quick answers

**Is CVE-2026-97208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97208 being exploited in the wild.

**How severe is CVE-2026-97208?** Informational severity, published 6 October 2026.

**Which products and versions are affected?** Gitea before 28.1.0.

**Is there a fix for CVE-2026-97208?** Yes: fixed in Gitea 28.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97208 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97208?** Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Gitea 28.1.0

## Technical details

The POST `/api/v1/repos/{owner}/{repo}/push_mirrors` API endpoint checked only whether mirroring was enabled globally but failed to verify the `[mirror] DISABLE_NEW_PUSH` configuration setting that the web interface enforces. This is an authorization check bypass where a repository administrator (a user with elevated privileges within a repo but not site-wide admin) could circumvent site-level policy. The vulnerability requires authentication and repository admin privileges; the fix validates the caller's permission against the site configuration before allowing mirror creation.

## Affected products

- Gitea Gitea before 28.1.0

## Timeline

- 2026-10-06: disclosed
- 2026-10-06: patched

## References

- [https://blog.gitea.com/release-of-28.1.0/](https://blog.gitea.com/release-of-28.1.0/)
- [https://github.com/go-gitea/gitea/pull/39501](https://github.com/go-gitea/gitea/pull/39501)

## Related threats

- [Gitea account takeover via OAuth2 auto-linking](https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the)
- [Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and)
- [Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http)
- [Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull)
- [Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an)