https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T15:57:12.358809+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-333340 EUVD-2026-333340 2026-10-04T15:57:12.425149+00:00 EUVD-2026-333340 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58423 fkie_cve-2026-58423 2026-10-04T15:57:12.425186+00:00

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

 https://cve.radiocsirt.org/vuln/ghsa-7wvc-rvp7-w99x GHSA-7wvc-rvp7-w99x — Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories 2026-10-04T15:57:12.425219+00:00

Affected: Go: code.gitea.io/gitea

### Summary

A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository.

### Details

In `cmd/serv.go`, the `getAccessMode` function determines the required access level for SSH operations. For LFS verbs (`git-lfs-authenticate`, `git-lfs-transfer`), it switches on the sub-verb (`upload`/`download`). If the sub-verb is neither, execution falls through to:

```go setting.PanicInDevOrTesting("unknown verb: %s %s", verb, lfsVerb) return perm.AccessModeNone ```

In production (`IsProd=true`), `PanicInDevOrTesting` only logs an error and does not panic. `AccessModeNone` (value `0`) is then passed to `ServCommand` in `routers/private/serv.go`, where the permission check block at line ~322 evaluates:

```go if repoExist && (mode > perm.AccessModeRead || repo.IsPrivate || owner.Visibility.IsPrivate() || (user != nil && user.IsRestricted) || setting.Service.RequireSignInViewStrict) { ... if userMode < mode { // userMode < 0 is always false // deny access } } ```

For private repositories, `repo.IsPrivate` triggers the permission check block, but `userMode < mode` evaluates to `userMode < 0`, which is always false — **access is granted regardless of the user's actual permissions**.

The function then returns successfully, and `r…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149 WID-SEC-W-2026-2149 — Gitea: Mehrere Schwachstellen 2026-10-04T15:57:12.425281+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.