Gitea releases prior to version 1.25.5 omit the migration HTTP transport when handling Large File Storage (LFS) push and mirror‑synchronization requests. Normally, the migration transport enforces both authentication controls and transport‑level security on LFS endpoints; by routing these requests through the default LFS transport the system ignores any configured migration restrictions. This flaw provides a classic authorization bypass (CWE‑284) that allows an attacker to read or write large‑file objects that should otherwise be protected. The impact is that an attacker who can initiate an LFS push or trigger a mirror synchronization against a Gitea instance that has migration transport restrictions configured will be able to bypass those controls. The vulnerability can lead to unauthorized disclosure of repository contents that include large files, or insertion of malicious files into the repository. Attackers would need network access to the Gitea HTTP endpoint and the ability to perform either an LFS push or a mirror‑synchronization. While the EPSS score of less than 1 % indicates the likelihood of an active exploit is currently low, the critical CVSS score (9.8) demonstrates that a successful exploitation could have a serious impact. The vulnerability is not currently listed in the CISA KEV catalog, implying no known large‑scale exploitation at the time of this report.

The affected systems are instances of Gitea version 1.25.4 and earlier of the Gitea Open Source Git Server. Any deployment using Gitea before the 1.25.5 release is vulnerable, regardless of repository size or network exposure.

The high CVSS score of 9.8 reflects a severe potential impact, while the EPSS score of less than 1 % indicates that active exploitation is currently rare. The vulnerability would be exploited by an attacker who can reach the Gitea HTTP endpoint and initiate an LFS push or mirror sync. Because the flaw bypasses migration transport restrictions, it enables unauthorized reading or writing of large-file content, potentially leaking or tampering with repository data. The flaw is not yet identified in CISA’s KEV catalog, so no large‑scale incidents have been reported as of this analysis.