Vulnerability Description
Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.
CVSS Score
7.1
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Related Weaknesses (CWE)
References
- https://blog.gitea.com/release-of-1.26.3-and-1.26.4/
- https://github.com/go-gitea/gitea/pull/38050
- https://github.com/go-gitea/gitea/releases/tag/v1.26.3
- https://github.com/go-gitea/gitea/security/advisories/GHSA-2m9v-5q2g-58vq
FAQ
What is CVE-2026-28740?
CVE-2026-28740 is a vulnerability with a CVSS score of 7.1 (HIGH). Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.
How severe is CVE-2026-28740?
CVE-2026-28740 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-28740?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.