# CVE-2026-28740: Gitea authorization bypass in Git LFS object reuse

Source: https://junglewise.ai/threats/cve-2026-28740-gitea-authorization-bypass-in-git-lfs-object-reuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-28740 · Severity: high · CVSS 7.1 · Published 2026-07-03

Gitea is an open-source forge software package for hosting software development version control using Git. A vulnerability in the Git Large File Storage (LFS) component allows an authenticated user to access private files from repositories they shouldn't be able to see. By knowing the specific identifier of a large file in a private repository, an attacker with basic access (like issue tracking) can trick the system into linking that file to their own repository, leading to the unauthorized disclosure of private source code or data.

Technologies: [Gitea](https://junglewise.ai/threats/technologies/gitea), [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea), [gitea.dev (Go)](https://junglewise.ai/threats/technologies/gitea-dev). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-28740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28740 being exploited in the wild.

**How severe is CVE-2026-28740?** High severity, with a CVSS score of 7.1, published 3 July 2026.

**Which products and versions are affected?** Gitea < 1.26.3, <= 1.26.2; code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.26.3; gitea.dev (Go) < 1.26.3, SEMVER:introduced=0,fixed=1.26.3.

**Is there a fix for CVE-2026-28740?** Yes. code.gitea.io/gitea (Go): upgrade to 1.26.3 or later; gitea.dev (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28740 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-28740?** Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.gitea.io/gitea (Go): upgrade to 1.26.3 or later

  ```sh
  go get code.gitea.io/gitea@v1.26.3
  ```

- gitea.dev (Go): upgrade to 1.26.3 or later

  ```sh
  go get gitea.dev@v1.26.3
  ```


## Technical details

An authorization bypass exists in Gitea's Git LFS object reuse logic within `services/lfs/server.go`. The root cause is the use of `repo_model.AccessibleRepositoryCondition` with `unit.TypeInvalid`, which performs a broad repository accessibility check rather than enforcing specific 'Code' unit permissions. An attacker with an authenticated account and write access to a 'target' repository can associate an LFS object from a 'source' repository to which they only have non-Code access (e.g., via organization team membership granting only Issues access). If the attacker knows the LFS object's OID and size, they can successfully invoke the `BatchHandler` or `UploadHandler` to reuse the object, potentially making it downloadable through their own repository. This has been patched in version 1.26.3.

## Affected products

- Gitea Gitea < 1.26.3

## Identifiers

- CVE-2026-28740
- GHSA-2m9v-5q2g-58vq
- GO-2026-6029

## Timeline

- 2026-06-21: disclosed: Initial report to Gitea
- 2026-07-03: advisory: NVD publication date
- 2026-07-21: patched: GitHub Advisory published and fix confirmed in 1.26.3

## References

- [https://api.github.com/users/m2hcz](https://api.github.com/users/m2hcz)
- [https://github.com/m2hcz](https://github.com/m2hcz)
- [https://api.github.com/users/m2hcz/gists%7B/gist_id%7D](https://api.github.com/users/m2hcz/gists%7B/gist_id%7D)
- [https://api.github.com/users/m2hcz/repos](https://api.github.com/users/m2hcz/repos)
- [https://avatars.githubusercontent.com/u/202376560?v=4](https://avatars.githubusercontent.com/u/202376560?v=4)
- [https://api.github.com/users/m2hcz/events%7B/privacy%7D](https://api.github.com/users/m2hcz/events%7B/privacy%7D)

## Related threats

- [Gitea account takeover via OAuth2 auto-linking](https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the)
- [Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and)
- [Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http)
- [Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull)
- [Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an)