Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.7 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

• CVE-2026-58423: 0.39% estimated exploitation activity in the next 30 days; percentile 33.53 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository. Details In cmd/serv.go, the getAccessMode function determines the required access level for SSH operations. For LFS verbs (git-lfs-authenticate, git-lfs-transfer), it switches on the sub-verb (upload/download). If the sub-verb is neither, execution falls through to: In production (IsProd=true), PanicInDevOrTesting only logs an error and does not panic. AccessModeNone (value 0) is then passed to ServCommand in routers/private/serv.go, where the permission check block at line ~322 evaluates: For private repositories, repo.IsPrivate triggers the permission check block, but userMode < mode evaluates to userMode < 0, which is always false — access is granted regardless of the user's actual permissions. The…

Published by the source

21 Jul 2026, 20:35 UTC

Last modified by the source

21 Jul 2026, 20:35 UTC

Source last checked

26 Oct 2026, 15:27 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-7wvc-rvp7-w99x

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-58423

Advisory: Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
IDs: CVE-2026-58423, GHSA-7wvc-rvp7-w99x
Record: https://patchnext.com/advisories/cve-2026-58423 (revision 1, source checked 26 Oct 2026, 15:27 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.7)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: code.gitea.io/gitea 1.26.3. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go code.gitea.io/gitea: affected >= 1.23.0, < 1.26.3; fixed in 1.26.3

## Suggested inspection (read-only)
- Go code.gitea.io/gitea: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on code.gitea.io/gitea.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-7wvc-rvp7-w99x (GitHub-reviewed advisory GHSA-7wvc-rvp7-w99x lists affected ranges: Go code.gitea.io/gitea >=1.23.0 <1.26.3)

Commands are suggestions: review each one before running it.