CVE-2026-28740: Gitea Git LFS Authorization Bypass – HIGH Severity

Technical summary

CVE-2026-28740 is an authorization bypass (CWE-863) and improper access control vulnerability (CWE-639) in Gitea's Git LFS implementation. The vulnerability stems from insufficient permission validation when users request LFS objects. Specifically, the system fails to consistently enforce Code-unit access restrictions on LFS object retrieval, allowing users with repository-level access to retrieve LFS objects they should not be able to access. The attack requires network access and valid Gitea credentials, but no user interaction. The CVSS 3.1 score of 7.1 (HIGH) reflects high confidentiality impact with medium attack complexity due to the need for repository access and specific permission configuration.

Business impact

This vulnerability could lead to unauthorized disclosure of sensitive data stored in Git LFS repositories. Organizations using Gitea to manage private source code, documentation, or build artifacts may expose confidential intellectual property, API keys, credentials, or customer data if those assets are stored as LFS objects. The impact is particularly acute in multi-tenant or team-based Gitea deployments where fine-grained code access controls are relied upon for security isolation. Incident response and forensics would be complicated by the need to audit which LFS objects were accessed and by which users.

Affected systems

Gitea versions up to and including 1.26.2 are affected. This includes all installations running 1.26.2 or earlier, spanning multiple deployment models: self-hosted instances, containerized deployments, and cloud-hosted Gitea services. The vulnerability is not vendor-specific; it affects any Gitea instance at the vulnerable version level, regardless of platform or configuration.

Exploitability

The vulnerability requires an authenticated attacker with at least basic repository access privileges—a relatively low bar in many organizational Gitea deployments where developers routinely have read access to multiple repositories. No special tools, credentials beyond basic access, or user interaction are required; exploitation is straightforward once an attacker identifies the presence of LFS objects in a target repository. However, attack complexity is rated as high because the vulnerability only manifests when Code-unit access restrictions are explicitly configured and the target repository uses Git LFS, which is not always enabled. Real-world exploitability depends on how organizations structure their repository permissions.

Remediation

Upgrade Gitea to a patched version that implements proper authorization checks for LFS object access. Verify the specific patch version against the official Gitea security advisory and release notes. Organizations unable to upgrade immediately should review repository permission assignments, particularly those using Code-unit access controls, and audit Gitea logs for unexpected LFS object requests from users with restricted code access. Consider restricting LFS usage to trusted users or limiting repository access until patching is possible.

Patch guidance

Consult the official Gitea security advisory and release notes to identify the patched version that addresses CVE-2026-28740. Apply the patch through your Gitea deployment method: direct binary upgrade for self-hosted instances, container image updates for Docker/Kubernetes deployments, or coordination with your Gitea hosting provider for managed instances. Plan for a maintenance window; while the upgrade does not require data migration, restarting the Gitea service is necessary. Test the patch in a staging environment against your permission-configuration patterns before production deployment.

Detection guidance

Monitor Gitea API logs and audit trails for LFS object requests (typically POST/GET to /api/v1/repos/.../lfs/objects endpoints) from users with restricted or limited repository permissions. Examine access patterns for users whose roles lack Code-unit access; such users should not be retrieving LFS objects. Review Git LFS pointer files and object metadata to identify which users have downloaded large binary artifacts. Correlate with user role assignments to find anomalies. Consider implementing a temporary LFS object access logging enhancement if your Gitea version does not natively expose this level of detail.

Why prioritize this

This vulnerability merits priority remediation due to its HIGH CVSS score, authenticated-but-low-barrier attack vector, and direct confidentiality impact on intellectual property and sensitive data. Organizations with multi-team Gitea instances or those storing secrets, credentials, or proprietary binaries as LFS objects should prioritize patching. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, but the low exploitation complexity and relatively high environmental prevalence (Gitea's growing adoption in enterprise) justify prompt action. Delay increases the window for unauthorized data access.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: Network-accessible attack surface (AV:N), high attack complexity due to the need for repository access and specific permission configuration (AC:H), requirement for low-privilege authenticated credentials (PR:L), no user interaction (UI:N), scope change because compromised access extends beyond the immediate user's intended scope (S:C), high confidentiality impact (C:H) from unauthorized data disclosure, low integrity impact (I:L) from potential indirect data manipulation, and no availability impact (A:N). The score appropriately balances the low barrier to entry for attackers with existing repository access against the focused impact on data confidentiality.

Frequently asked questions