Junglewise Threat Intelligence

CVE-2026-58435: Gitea LFS privilege escalation via deploy key impersonation

CVE-2026-58435 · Severity: medium · CVSS 5.4 · Published 2026-07-21

Technologies: code.gitea.io/gitea (Go), Gitea, gitea.dev (Go). Vendors: Go, Gitea.

Executive brief

Gitea, a popular self-hosted Git service, contains a vulnerability that allows users with limited access to one repository to access private data in other repositories owned by the same person. Specifically, if an attacker has a 'deploy key' (a common way to grant automated systems access to a single project), they can trick the system into letting them download large files (LFS objects) from any of the owner's other private projects. If the victim is a site administrator, the attacker could potentially access large files across the entire Gitea instance. This breaks the security isolation intended for automated tools and could lead to the theft of sensitive intellectual property or credentials stored in large file storage.

Technical details

A trust-boundary confusion exists between Gitea's SSH authentication and LFS server subsystems. When a deploy key authenticates via SSH, 'routers/private/serv.go' incorrectly sets the JWT 'UserID' to the repository 'OwnerID' instead of a unique identity for the deploy key. The LFS server in 'services/lfs/server.go' subsequently uses this 'UserID' claim to perform cross-repository authorization checks via 'LFSObjectAccessible()'. An attacker holding a write deploy key can obtain a valid JWT and use the LFS batch API to link and download LFS objects from any repository the owner can access, provided the attacker knows the object's SHA-256 OID. If the owner is an administrator, this grants access to all LFS objects on the instance. The vulnerability is patched in version 1.27.0.

Affected products

  • Gitea Gitea < 1.27.0

Timeline

  • 2026-07-13: advisory: Initial GitHub Advisory published
  • 2026-07-21: patched: Updated advisory and fix availability confirmed

References

Related threats