CVE-2026-28740: Gitea: Git LFS object reuse allows non-Code access to authorize private source objects
A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object.
The issue appears to be caused by the source-object authorization check using broad repository accessibility instead of requiring Code-unit access to at least one repository that owns the requested LFS object.
References
- blog.gitea.com/release-of-1.26.3-and-1.26.4
- github.com/advisories/GHSA-2m9v-5q2g-58vq
- github.com/go-gitea/gitea/commit/1c7b7ea72df7cf81e88b8e09049608254d32e56e
- github.com/go-gitea/gitea/commit/7b4a1a1a118501b9d0260301dfed7f52dfc36ee9
- github.com/go-gitea/gitea/pull/38050
- github.com/go-gitea/gitea/releases/tag/v1.26.3
- github.com/go-gitea/gitea/security/advisories/GHSA-2m9v-5q2g-58vq
- nvd.nist.gov/vuln/detail/CVE-2026-28740
Code Behaviors & Features
Detect and mitigate CVE-2026-28740 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →