CVE-2026-28740CWE-639CWE-863

Gitea LFS object reuse bypasses Code-unit authorization

High · published July 3, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.1th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-863 · Incorrect Authorization
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea LFS object reuse bypasses Code-unit authorization
    cvelistv5