CVE-2026-28740
published 2026-07-03CVE-2026-28740: Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack…
PriorityP341high7.1CVSS 3.1
AVNACHPRLUINSCCHILAN
EPSS
0.27%
19.0th percentile
Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitea | gitea_open_source_git_server | <= 1.26.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: Git LFS object reuse allows non-Code access to authorize private source objects
ghsa·2026-07-21
CVE-2026-28740 [HIGH] CWE-639 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects
Gitea: Git LFS object reuse allows non-Code access to authorize private source objects
## Summary
A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object.
The issue appears to be caused by the source-object authorization check using broad repository accessibility instead of requiring Code-unit access to at least one repository that owns the requested LFS object.
## Impact
This issue breaks the expected authorization boundary between repository units.
A user who does not have Code access to a private source repository should not be able to reuse or associate Git LFS objects owned by
VulDB
Gitea up to 1.26.2 authorization (GHSA-2m9v-5q2g-58vq)
vuldb·2026-07-04·CVSS 7.1
CVE-2026-28740 [HIGH] Gitea up to 1.26.2 authorization (GHSA-2m9v-5q2g-58vq)
A vulnerability was found in Gitea up to 1.26.2. It has been declared as problematic. This issue affects some unknown processing. Executing a manipulation can lead to authorization bypass.
This vulnerability is registered as CVE-2026-28740. It is possible to launch the attack remotely. No exploit is available.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-03
Published