Executive brief
Gitea is an open-source forge software package for hosting software development version control using Git. A vulnerability in the Git Large File Storage (LFS) component allows an authenticated user to access private files from repositories they shouldn't be able to see. By knowing the specific identifier of a large file in a private repository, an attacker with basic access (like issue tracking) can trick the system into linking that file to their own repository, leading to the unauthorized disclosure of private source code or data.
Technical details
An authorization bypass exists in Gitea's Git LFS object reuse logic within `services/lfs/server.go`. The root cause is the use of `repo_model.AccessibleRepositoryCondition` with `unit.TypeInvalid`, which performs a broad repository accessibility check rather than enforcing specific 'Code' unit permissions. An attacker with an authenticated account and write access to a 'target' repository can associate an LFS object from a 'source' repository to which they only have non-Code access (e.g., via organization team membership granting only Issues access). If the attacker knows the LFS object's OID and size, they can successfully invoke the `BatchHandler` or `UploadHandler` to reuse the object, potentially making it downloadable through their own repository. This has been patched in version 1.26.3.
Affected products
- Gitea Gitea < 1.26.3
Timeline
- 2026-06-21: disclosed: Initial report to Gitea
- 2026-07-03: advisory: NVD publication date
- 2026-07-21: patched: GitHub Advisory published and fix confirmed in 1.26.3