Vulnerability details

CVE-2026-28740

Gitea Open Source Git Server

Gitea LFS object reuse bypasses Code-unit authorization

CVSS 3.1

7.1High

Official description

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

CVSS scores

Score	Version	Source	Vector
7.1High	3.1	CVEProject cvelistV5 (CNA) (Gitea)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N`

Affected products

Vendor	Product	Versions	Source
Gitea	Gitea Open Source Git Server	v ≤ 1.26.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/go-gitea/gitea/security/advisories/GHSA-2m9v-5q2g-58vq vendor-advisory
https://github.com/go-gitea/gitea/pull/38050 patch
https://github.com/go-gitea/gitea/releases/tag/v1.26.3 release-notes
https://blog.gitea.com/release-of-1.26.3-and-1.26.4/ release-notes

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-03
Last updated: 2026-07-07
State: Published
Assigner (CNA): Gitea

Exploit prediction (EPSS)

0.32%

Probability of exploitation in 30 days

25.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-639
CWE-863