High severity · published Jul 3, 2026
CVE-2026-28740
Gitea LFS object reuse bypasses Code-unit authorization
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
Gitea Open Source Git Server · Gitea
through 1.26.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28740
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28740
blog.gitea.com
https://blog.gitea.com/release-of-1.26.3-and-1.26.4/
github.com
https://github.com/go-gitea/gitea/pull/38050
github.com
https://github.com/go-gitea/gitea/releases/tag/v1.26.3
github.com
https://github.com/go-gitea/gitea/security/advisories/GHSA-2m9v-5q2g-58vq
More from Gitea Open Source Git Server
9.8
CVE-2026-56654
Privilege Escalation via Access Token Scope Escalation in API
9.8
CVE-2026-58422
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
9.8
CVE-2026-27780
Gitea pre-receive hook can miss branch-protection checks after scanner errors
9.8
CVE-2026-26292
Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
9.8
CVE-2026-20896
Gitea Docker image trusts spoofable reverse-proxy headers by default