EUVD-2026-41606
GHSA-7wvc-rvp7-w99x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network SSH access with a low-privileged account (PR:L), low complexity to craft the malformed sub-verb, scope change crossing the authorization boundary, and read-only exposure of private data (C:H, I/A:N).
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
AnalysisAI
Authentication bypass in Gitea's Git LFS (Large File Storage) SSH handling allows a low-privileged authenticated user to read files from private repositories they should not access by supplying a malformed SSH sub-verb, per the Gitea security advisory GHSA-7wvc-rvp7-w99x. Because the flaw crosses a security boundary (CVSS scope change) it exposes confidential repository contents without any integrity or availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available in Gitea 1.26.4.
Technical ContextAI
Gitea is a self-hosted Git service written in Go. The vulnerable component is its Git LFS transfer protocol handling over SSH: Gitea exposes LFS operations through SSH by parsing a sub-command/sub-verb passed alongside the git-lfs-authenticate flow. CWE-287 (Improper Authentication) is the root cause class - the SSH sub-verb parser fails to correctly validate or bind the requested LFS operation to the caller's authorization context, so a crafted/malformed sub-verb slips past the access-control check that normally restricts private-repository reads. The affected product per CPE is cpe:2.3:a:gitea:gitea_open_source_git_server, i.e. the Gitea Open Source Git Server across versions prior to the 1.26.4 fix.
RemediationAI
Vendor-released patch: Gitea 1.26.4 - upgrade all instances to 1.26.4 (or later) as documented in the release notes at https://github.com/go-gitea/gitea/releases/tag/v1.26.4 and the announcement at https://blog.gitea.com/release-of-1.26.3-and-1.26.4/, following the advisory at https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x and PR https://github.com/go-gitea/gitea/pull/38008. If immediate patching is not possible, compensating controls include disabling Git LFS on the instance (trade-off: breaks LFS-backed repositories and large-file workflows), and restricting SSH access to the Gitea service to trusted networks or vetted accounts and disabling open self-registration so untrusted users cannot obtain the low-privileged account the exploit requires (trade-off: reduces convenience/self-service onboarding). Audit access logs for anomalous LFS-authenticate SSH activity against private repositories in the interim.
More in Gitea Open Source Git Server
View allBroken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Branch-protection bypass in Gitea's self-hosted Git server (all versions before 1.26.0) allows a user with push access t
Migration transport protections in Gitea are bypassed for Git LFS operations, affecting all self-hosted instances before
Authorization bypass in Gitea Open Source Git Server (versions up to and including 1.26.1) allows a user whose account w
Server-side request forgery in Gitea versions up to and including 1.26.2 lets authenticated users abuse incomplete allow
Cross-repository information disclosure and cross-task tampering in Gitea's self-hosted Git server (fixed in v1.26.2) ar
Arbitrary file read and write in Gitea before 1.25.5 arises when the template repository generation feature resolves pat
Improper input validation in Gitea Open Source Git Server before 1.25.5 lets authenticated users submit repository-creat
Authentication bypass via OAuth2 authorization code replay in Gitea before 1.25.5, where the server fails to consistentl
OAuth2 PKCE protection bypass in Gitea before 1.25.5 allows remote attackers to complete an authorization-code token exc
Broken access control in Gitea (self-hosted Git service) versions up to and including 1.26.4 lets the team-repository li
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today