Git LFS Object Reuse in Gitea Allows Unauthorized Access

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-28740

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 1.26.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Gitea versions up to and including 1.26.2. It allows Git LFS (Large File Storage) object reuse to authorize access to private source objects for users who have access to the repository but do not have the necessary Code-unit access.

Impact Analysis

The vulnerability can lead to unauthorized access to private source objects by users who should not have such access. This means sensitive or private data stored in Git LFS objects could be exposed to users with limited permissions, potentially leading to data leakage or compromise.

Hi! I’m here to help you understand CVE-2026-28740. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70