Gitea CVE-2026-28740

Exploitation requires the target repository to use Git LFS and the attacker to already hold a repository access grant on that repository while lacking the Code unit permission - that specific over-provisioned-but-Code-restricted membership state IS the condition. Limiting factors: the attacker must be authenticated with existing repository access (PR:L, not anonymous), the attack has high complexity (AC:H) requiring manipulation of LFS object reuse/authorization, and it only exposes private source objects handled via LFS; repositories not using LFS or where users have no access at all are not exploitable this way. Impact is confined to unauthorized reading of confidential source (no integrity/availability destruction).

This is a moderate, real but not urgent priority. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, base 7.1) shows a network-reachable but authenticated (PR:L) attack with high complexity (AC:H) and a scope change, with the dominant impact being confidentiality (C:H) - consistent with unauthorized reading of private source. AC:H and PR:L meaningfully lower real-world exploitability: an attacker must already be a repository member and must manipulate LFS object reuse, so this is not mass-exploitable. No EPSS score, POC, or KEV entry was provided, so there is no signal of active or automated exploitation; the risk is targeted insider/over-provisioned-user information disclosure rather than widespread compromise. No conflicting signals were found between the vector and the description - both point to authenticated, low-privilege access escalating read scope.

An authenticated Gitea user who was granted limited repository access (for example, Issues or Wiki) but deliberately denied the Code unit crafts LFS object requests that reuse/authorize private source objects, retrieving confidential source content they should not be able to read. Because AC:H applies, the attacker must understand and manipulate the LFS object-reuse mechanism, but no elevated privileges or victim interaction are required. No public POC was identified at time of analysis.