Gitea · Gitea · CVE-2026-58435
**Name of the Vulnerable Software and Affected Versions**
Gitea version 1.25.5
**Description**
An insufficient authorization issue exists in the LFS server where the system uses the `UserID` embedded in an LFS JWT to make cross-repository authorization decisions via the `LFSObjectAccessible()` function. When a deploy key is used for authentication, the system incorrectly sets the `UserID` to the repository owner's ID instead of an identity representing the deploy key. This allows an attacker with a write deploy key for any single repository owned by a victim to obtain a JWT that impersonates the victim. Consequently, the attacker can exfiltrate LFS objects from any private repository the victim owns, provided the attacker knows the SHA-256 OID of the target object. If the victim is a site administrator, all LFS objects on the Gitea instance may be accessible. The issue is reachable via the SSH `git-lfs-authenticate` command and the HTTP LFS batch API endpoint `/info/lfs/objects/batch` when `LFS START SERVER` is enabled.
**Recommendations**
For version 1.25.5, remove the `LFSObjectAccessible` cross-repo shortcut in `services/lfs/server.go` to require proof of possession for any object not already linked to the target repository.
For version 1.25.5, modify `routers/private/serv.go` to stop embedding the `repo.OwnerID` in the JWT for deploy keys, instead using a synthetic principal or a repo-scoped JWT type.
As a temporary mitigation, restrict access to the LFS batch API endpoint `/info/lfs/objects/batch` to minimize the risk of exploitation.