Incorrect Privilege Assignment in Gitea - CVE-2026-58435
Published: July 14, 2026
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information from private repositories.
The vulnerability exists due to incorrect privilege assignment in the Gitea LFS server and deploy-key authentication flow when handling SSH git-lfs-authenticate requests and subsequent HTTP LFS batch API requests. A remote user can use a write deploy key for one repository to obtain a valid LFS JWT and submit a crafted batch upload request to disclose sensitive information from other private repositories owned by the same victim.
Successful exploitation requires that the LFS server is enabled and that the attacker knows the SHA-256 OID of a target LFS object. If the victim is a site administrator, LFS objects across the entire instance may be reachable.