CVE-2026-58435
Received Received - Intake

Gitea LFS Deploy-Key Privilege Escalation

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Gitea LFS Deploy-Key Privilege Escalation

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-58435
EUVD
EUVD-2026-58162

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitea gitea to 1.25.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in Gitea's Large File Storage (LFS) component affecting versions up to 1.25.5. It involves improper handling of deploy keys, which are meant for limited repository access. When used via SSH, Gitea incorrectly embeds the repository owner's UserID into the LFS JWT instead of the deploy key's identity. This allows an attacker with a write deploy key to impersonate the repository owner for cross-repository LFS operations.

Detection Guidance

Check Gitea version with 'gitea --version' or inspect the web interface footer. Look for unauthorized LFS object access in logs or audit trails. Review deploy keys in repositories for unexpected or excessive permissions.

Impact Analysis

An attacker could exfiltrate LFS objects from any private repository owned by the victim, including those they administer. If the victim is a site administrator, the attacker gains access to all LFS objects across the entire Gitea instance. The exploit requires knowledge of the SHA-256 OID of a specific LFS object, which may be obtained through public forks or shared data.

Mitigation Strategies

Upgrade Gitea to version 1.25.6 or later. Temporarily disable LFS cross-repository access by modifying services/lfs/server.go to remove the shortcut. Audit and revoke unnecessary deploy keys across all repositories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart