CVE-2026-129337

not scored yet · published 2026-11-15

Git over HTTP lowers the required permission for pushes to read access, so that the AGit flow works, and relies on the repository's server-side hooks to enforce write access. A repository that is still being created by a migration, fork or template generation has no hooks yet, so a user with read access to it could push branches and tags during that window, or after a failed migration that left the repository in that state. Git over HTTP now refuses requests to repositories that are still being created.

Weakness: CWE-862

Source: NVD CVE-2026-129337

References

• https://blog.gitea.com/release-of-28.4.0/
• https://github.com/go-gitea/gitea/pull/40120
• https://github.com/go-gitea/gitea/pull/40268
• https://github.com/go-gitea/gitea/releases/tag/v28.4.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-8cjj-9p56-j54f

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.