EUVD-2026-41643
GHSA-2m9v-5q2g-58vq
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Authenticated repo member (PR:L) exploiting LFS reuse over the network (AV:N) with non-trivial mechanics (AC:H); impact is unauthorized read of private source across a permission boundary (S:C, C:H) with no integrity or availability effect.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.
AnalysisAI
Broken authorization in Gitea (self-hosted Git service) versions up to and including 1.26.2 lets a user who holds general repository access but has NOT been granted the Code unit permission read private source content by reusing Git LFS objects to authorize otherwise-restricted source objects. The flaw (CWE-639, tracked as GHSA-2m9v-5q2g-58vq) enables horizontal privilege escalation to confidential code within a repository. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch shipped in 1.26.3.
Technical ContextAI
Gitea is an open-source, self-hosted Git server (cpe:2.3:a:gitea:gitea_open_source_git_server) that implements fine-grained per-unit permissions, splitting repository access into units such as Code, Issues, Wiki, and Releases. Git LFS (Large File Storage) stores large binary content as pointer objects referenced by OID, and Gitea reuses/deduplicates these objects across access paths. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the LFS object-reuse/authorization path keys access on repository membership rather than re-checking the granular Code unit permission, so an object that should be gated behind Code-unit access becomes retrievable by any user with a lower-tier repository grant.
RemediationAI
Vendor-released patch: 1.26.3 - upgrade all Gitea instances from any release up to and including 1.26.2 to 1.26.3 (or later, e.g. 1.26.4), as described at https://blog.gitea.com/release-of-1.26.3-and-1.26.4/ and tagged at https://github.com/go-gitea/gitea/releases/tag/v1.26.3; the code fix is in PR https://github.com/go-gitea/gitea/pull/38050. If immediate upgrade is not possible, reduce exposure by tightening repository membership so that only users who legitimately need source access hold any access to sensitive private repositories (removing the over-provisioned users this bug targets), and consider disabling Git LFS on repositories containing confidential source where LFS is not required - note this side effect will break existing LFS pointer content and large-file workflows for those repositories. Review the vendor advisory GHSA-2m9v-5q2g-58vq for authoritative guidance.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today