# CVE-2026-58435: Gitea LFS privilege escalation via deploy key impersonation

Source: https://junglewise.ai/threats/cve-2026-58435-gitea-lfs-privilege-escalation-via-deploy-key-impersonation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-58435 · Severity: medium · CVSS 5.4 · Published 2026-07-21

Gitea, a popular self-hosted Git service, contains a vulnerability that allows users with limited access to one repository to access private data in other repositories owned by the same person. Specifically, if an attacker has a 'deploy key' (a common way to grant automated systems access to a single project), they can trick the system into letting them download large files (LFS objects) from any of the owner's other private projects. If the victim is a site administrator, the attacker could potentially access large files across the entire Gitea instance. This breaks the security isolation intended for automated tools and could lead to the theft of sensitive intellectual property or credentials stored in large file storage.

Technologies: [Gitea](https://junglewise.ai/threats/technologies/gitea), [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea), [gitea.dev (Go)](https://junglewise.ai/threats/technologies/gitea-dev). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-58435 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58435 being exploited in the wild.

**How severe is CVE-2026-58435?** Medium severity, with a CVSS score of 5.4, published 21 July 2026.

**Which products and versions are affected?** Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

**Is there a fix for CVE-2026-58435?** Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58435 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58435?** Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.gitea.io/gitea (Go): upgrade to 1.27.0 or later

  ```sh
  go get code.gitea.io/gitea@v1.27.0
  ```

- gitea.dev (Go): upgrade to 1.27.0 or later

  ```sh
  go get gitea.dev@v1.27.0
  ```


## Technical details

A trust-boundary confusion exists between Gitea's SSH authentication and LFS server subsystems. When a deploy key authenticates via SSH, 'routers/private/serv.go' incorrectly sets the JWT 'UserID' to the repository 'OwnerID' instead of a unique identity for the deploy key. The LFS server in 'services/lfs/server.go' subsequently uses this 'UserID' claim to perform cross-repository authorization checks via 'LFSObjectAccessible()'. An attacker holding a write deploy key can obtain a valid JWT and use the LFS batch API to link and download LFS objects from any repository the owner can access, provided the attacker knows the object's SHA-256 OID. If the owner is an administrator, this grants access to all LFS objects on the instance. The vulnerability is patched in version 1.27.0.

## Affected products

- Gitea Gitea < 1.27.0

## Identifiers

- CVE-2026-58435
- GHSA-rh79-75qm-gwjr
- GO-2026-6073

## Timeline

- 2026-07-13: advisory: Initial GitHub Advisory published
- 2026-07-21: patched: Updated advisory and fix availability confirmed

## References

- [https://api.github.com/users/adrian-doyensec](https://api.github.com/users/adrian-doyensec)
- [https://github.com/adrian-doyensec](https://github.com/adrian-doyensec)
- [https://api.github.com/users/adrian-doyensec/gists%7B/gist_id%7D](https://api.github.com/users/adrian-doyensec/gists%7B/gist_id%7D)
- [https://api.github.com/users/adrian-doyensec/repos](https://api.github.com/users/adrian-doyensec/repos)
- [https://avatars.githubusercontent.com/u/104771553?v=4](https://avatars.githubusercontent.com/u/104771553?v=4)
- [https://api.github.com/users/adrian-doyensec/events%7B/privacy%7D](https://api.github.com/users/adrian-doyensec/events%7B/privacy%7D)

## Related threats

- [Gitea account takeover via OAuth2 auto-linking](https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the)
- [Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and)
- [Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http)
- [Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull)
- [Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an)