{"id":"EUVD-2026-41606","enisaUuid":"87760dc7-4bd2-32ca-b54e-69884c803d03","description":"LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories","datePublished":"Jul 3, 2026, 8:54:52 PM","dateUpdated":"Jul 6, 2026, 3:09:55 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x\nhttps://github.com/go-gitea/gitea/pull/38008\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.4\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","aliases":"CVE-2026-58423\nGHSA-7wvc-rvp7-w99x\n","assigner":"Gitea","epss":0.39,"enisaIdProduct":[{"id":"65cb4fa6-139d-3752-b940-a177ae3bdef3","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"1.23.0 ≤1.26.2"}],"enisaIdVendor":[{"id":"85a2d173-f8a8-3b9f-bca5-ec864e30284e","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"32e92d71-d70e-3d62-a309-225ac567e435","vulnerability":{"id":"CVE-2026-58423","description":"LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories","datePublished":"Jul 3, 2026, 8:54:52 PM","dateUpdated":"Jul 6, 2026, 3:09:55 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x\nhttps://github.com/go-gitea/gitea/pull/38008\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.4\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","enisa_id":"EUVD-2026-41606\n","assigner":"Gitea","epss":0.39,"dataProcessed":"Nov 1, 2026, 7:18:36 AM","vulnerabilityProduct":[{"id":"45b652dd-612a-387d-888f-3694135e5be8","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"1.23.0 ≤1.26.2"}],"vulnerabilityVendor":[{"id":"8d900b11-34df-3468-aab5-6a213f279cc4","vendor":{"name":"Gitea"}}]}},{"id":"de775a0b-945b-379d-b9cb-93f2a26c2ffe","vulnerability":{"id":"GHSA-7wvc-rvp7-w99x","description":"Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories","datePublished":"Jul 21, 2026, 8:35:09 PM","dateUpdated":"Jul 21, 2026, 8:35:10 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58423\nhttps://github.com/go-gitea/gitea/pull/38008\nhttps://github.com/go-gitea/gitea/commit/42513398c05ca6bdf71da76cb6f9baaebe8cb924\nhttps://github.com/go-gitea/gitea/commit/8f4b7ebbf6061bd44b1ab3824f17f37b87fb1740\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.4\n","enisa_id":"EUVD-2026-41606\n","aliases":"GHSA-7wvc-rvp7-w99x\nCVE-2026-58423\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}