CVE-2026-58435

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5

Description An insufficient authorization issue exists in the LFS server where the system uses the UserID embedded in an LFS JWT to make cross-repository authorization decisions via the LFSObjectAccessible() function. When a deploy key is used for authentication, the system incorrectly sets the UserID to the repository owner's ID instead of an identity representing the deploy key. This allows an attacker with a write deploy key for any single repository owned by a victim to obtain a JWT that impersonates the victim. Consequently, the attacker can exfiltrate LFS objects from any private repository the victim owns, provided the attacker knows the SHA-256 OID of the target object. If the victim is a site administrator, all LFS objects on the Gitea instance may be accessible. The issue is reachable via the SSH git-lfs-authenticate command and the HTTP LFS batch API endpoint /info/lfs/objects/batch when LFS START SERVER is enabled.

Recommendations For version 1.25.5, remove the LFSObjectAccessible cross-repo shortcut in services/lfs/server.go to require proof of possession for any object not already linked to the target repository. For version 1.25.5, modify routers/private/serv.go to stop embedding the repo.OwnerID in the JWT for deploy keys, instead using a synthetic principal or a repo-scoped JWT type. As a temporary mitigation, restrict access to the LFS batch API endpoint /info/lfs/objects/batch to minimize the risk of exploitation.