https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:02:32.481562+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352789 EUVD-2026-352789 2026-10-02T10:02:32.484590+00:00 EUVD-2026-352789 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58435 fkie_cve-2026-58435 2026-10-02T10:02:32.484621+00:00

Gitea LFS Deploy-Key Privilege Escalation

 https://cve.radiocsirt.org/vuln/ghsa-rh79-75qm-gwjr GHSA-rh79-75qm-gwjr — Gitea LFS Deploy-Key Privilege Escalation 2026-10-02T10:02:32.484649+00:00

Affected: Go: code.gitea.io/gitea

## Vulnerability Header

| Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location | `services/lfs/server.go:268`, `routers/private/serv.go:275` | | Affected Versions | 1.25.5 |

## Executive Summary

Gitea's LFS server (`services/lfs/server.go:268`) uses the `UserID` embedded in an LFS JWT to make cross-repository authorization decisions via `LFSObjectAccessible()`. This would be safe if the JWT `UserID` always matched the actual requesting principal — but for deploy keys, `routers/private/serv.go:275` sets `UserID = repo.OwnerID` instead of any identity representing the deploy key itself. As a result, an attacker who holds a write deploy key for any single repo owned by a victim can obtain a legitimate JWT (via the standard SSH `git-lfs-authenticate` flow) that Gitea will honor as if the victim themselves were making the request. The attacker can then exfiltrate LFS objects from any private repo the victim owns — no admin credentials, no server secrets, no brute force required. If the victim is a site administrator, every LFS object…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 WID-SEC-W-2026-2304 — Gitea: Mehrere Schwachstellen 2026-10-02T10:02:32.484747+00:00

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.