EUVD-2026-333340

fkie_cve-2026-58423

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

GHSA-7wvc-rvp7-w99x — Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Affected: Go: code.gitea.io/gitea

### Summary

A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository.

### Details

In `cmd/serv.go`, the `getAccessMode` function determines the required access level for SSH operations. For LFS verbs (`git-lfs-authenticate`, `git-lfs-transfer`), it switches on the sub-verb (`upload`/`download`). If the sub-verb is neither, execution falls through to:

```go setting.PanicInDevOrTesting("unknown verb: %s %s", verb, lfsVerb) return perm.AccessModeNone ```

In production (`IsProd=true`), `PanicInDevOrTesting` only logs an error and does not panic. `AccessModeNone` (value `0`) is then passed to `ServCommand` in `routers/private/serv.go`, where the permission check block at line ~322 evaluates:

```go if repoExist && (mode > perm.AccessModeRead || repo.IsPrivate || owner.Visibility.IsPrivate() || (user != nil && user.IsRestricted) || setting.Service.RequireSignInViewStrict) { ... if userMode < mode { // userMode < 0 is always false // deny access } } ```

For private repositories, `repo.IsPrivate` triggers the permission check block, but `userMode < mode` evaluates to `userMode < 0`, which is always false — **access is granted regardless of the user's actual permissions**.

The function then returns successfully, and `r…

WID-SEC-W-2026-2149 — Gitea: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Most recent entries from all

EUVD-2026-333340

fkie_cve-2026-58423

GHSA-7wvc-rvp7-w99x — Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

WID-SEC-W-2026-2149 — Gitea: Mehrere Schwachstellen