What is the CVSS score of CVE-2026-58423?

CVE-2026-58423 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Gitea are affected by CVE-2026-58423?

Gitea's Git LFS SSH handling contains an authentication bypass enabling low-privileged users to access confidential repository contents beyond their authorization.. A patch is available.

How to fix or mitigate CVE-2026-58423?

Within 24 hours: Audit all Gitea deployments to identify versions prior to 1.26.4 and evaluate private repository exposure. Within 7 days: Deploy Gitea 1.26.4 or later to all affected instances. Within 30 days: Review access logs for versions prior to 1.26.4 to detect any unauthorized repository access attempts.

Gitea CVE-2026-58423

EUVD-2026-41606 HIGH

Improper Authentication (CWE-287)

2026-07-03 Gitea

Authentication Bypass Gitea Open Source Git Server

7.7

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network SSH access with a low-privileged account (PR:L), low complexity to craft the malformed sub-verb, scope change crossing the authorization boundary, and read-only exposure of private data (C:H, I/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 21:54 vuln.today

DescriptionCVE.org

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

AnalysisAI

Authentication bypass in Gitea's Git LFS (Large File Storage) SSH handling allows a low-privileged authenticated user to read files from private repositories they should not access by supplying a malformed SSH sub-verb, per the Gitea security advisory GHSA-7wvc-rvp7-w99x. Because the flaw crosses a security boundary (CVSS scope change) it exposes confidential repository contents without any integrity or availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Gitea SSH with low-priv account

Delivery

Send git-lfs-authenticate with malformed sub-verb

Exploit

Bypass repository authorization check

Execution

Obtain LFS read token for private repo

Impact

Exfiltrate private LFS objects

Access

Authenticate to Gitea SSH with low-priv account

Delivery

Send git-lfs-authenticate with malformed sub-verb

Exploit

Bypass repository authorization check

Execution

Obtain LFS read token for private repo

Impact

Exfiltrate private LFS objects

Vulnerability AssessmentAI

Exploitation	Exploitation requires (1) a valid low-privileged authenticated Gitea account (CVSS PR:L - not unauthenticated), (2) network SSH access to the Gitea instance's Git-over-SSH endpoint, and (3) the target repositories using Git LFS, since the bypass is in the LFS git-lfs-authenticate SSH sub-verb parsing. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding high confidentiality impact with a scope change - consistent with a valid low-privileged account reading data outside its authorization boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A user with only a low-privileged account on a shared Gitea instance connects over SSH and issues a git-lfs-authenticate request carrying a malformed sub-verb, causing Gitea to grant an LFS read token for a private repository they are not a member of. They then pull the private repository's LFS-stored objects, exfiltrating source code or secrets. …
Remediation	Vendor-released patch: Gitea 1.26.4 - upgrade all instances to 1.26.4 (or later) as documented in the release notes at https://github.com/go-gitea/gitea/releases/tag/v1.26.4 and the announcement at https://blog.gitea.com/release-of-1.26.3-and-1.26.4/, following the advisory at https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x and PR https://github.com/go-gitea/gitea/pull/38008. … Detailed patch versions, workarounds, and compensating controls in full report.