Is CVE-2026-28740 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28740 being exploited in the wild.

How severe is CVE-2026-28740?

High severity, with a CVSS score of 7.1, published 3 July 2026.

Which products and versions are affected?

Gitea < 1.26.3, <= 1.26.2; code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.26.3; gitea.dev (Go) < 1.26.3, SEMVER:introduced=0,fixed=1.26.3.

Is there a fix for CVE-2026-28740?

Yes. code.gitea.io/gitea (Go): upgrade to 1.26.3 or later; gitea.dev (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28740 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28740?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28740: Gitea authorization bypass in Git LFS object reuse

Q: Which products and versions are affected?

Gitea < 1.26.3, <= 1.26.2; code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.26.3; gitea.dev (Go) < 1.26.3, SEMVER:introduced=0,fixed=1.26.3.

Q: Is there a fix for CVE-2026-28740?

Yes. code.gitea.io/gitea (Go): upgrade to 1.26.3 or later; gitea.dev (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-28740 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-28740?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28740 · Severity: high · CVSS 7.1 · Published 2026-07-03

Gitea is an open-source forge software package for hosting software development version control using Git. A vulnerability in the Git Large File Storage (LFS) component allows an authenticated user to access private files from repositories they shouldn't be able to see. By knowing the specific identifier of a large file in a private repository, an attacker with basic access (like issue tracking) can trick the system into linking that file to their own repository, leading to the unauthorized disclosure of private source code or data.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-28740 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28740 being exploited in the wild.
How severe is CVE-2026-28740?: High severity, with a CVSS score of 7.1, published 3 July 2026.
Which products and versions are affected?: Gitea < 1.26.3, <= 1.26.2; code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.26.3; gitea.dev (Go) < 1.26.3, SEMVER:introduced=0,fixed=1.26.3.
Is there a fix for CVE-2026-28740?: Yes. code.gitea.io/gitea (Go): upgrade to 1.26.3 or later; gitea.dev (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28740 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28740?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.26.3 or later
```
go get code.gitea.io/gitea@v1.26.3
```
gitea.dev (Go): upgrade to 1.26.3 or later
```
go get gitea.dev@v1.26.3
```

Technical details

An authorization bypass exists in Gitea's Git LFS object reuse logic within `services/lfs/server.go`. The root cause is the use of `repo_model.AccessibleRepositoryCondition` with `unit.TypeInvalid`, which performs a broad repository accessibility check rather than enforcing specific 'Code' unit permissions. An attacker with an authenticated account and write access to a 'target' repository can associate an LFS object from a 'source' repository to which they only have non-Code access (e.g., via organization team membership granting only Issues access). If the attacker knows the LFS object's OID and size, they can successfully invoke the `BatchHandler` or `UploadHandler` to reuse the object, potentially making it downloadable through their own repository. This has been patched in version 1.26.3.

Affected products

Gitea Gitea < 1.26.3

Identifiers

CVE-2026-28740
GHSA-2m9v-5q2g-58vq
GO-2026-6029

Timeline

2026-06-21: disclosed: Initial report to Gitea
2026-07-03: advisory: NVD publication date
2026-07-21: patched: GitHub Advisory published and fix confirmed in 1.26.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.