{"id":"EUVD-2026-41643","enisaUuid":"bcf555db-ae65-30ca-9380-da17989acab7","description":"Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.","datePublished":"Jul 3, 2026, 8:19:39 PM","dateUpdated":"Jul 7, 2026, 4:58:26 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2m9v-5q2g-58vq\nhttps://github.com/go-gitea/gitea/pull/38050\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","aliases":"CVE-2026-28740\nGHSA-2m9v-5q2g-58vq\n","assigner":"Gitea","epss":0.32,"enisaIdProduct":[{"id":"e22eef2d-75a2-3695-aac6-fadcebea12f1","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.2"}],"enisaIdVendor":[{"id":"57f31fea-9a13-3ae3-920f-3b7a8c8a5fdc","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"1e12c2ba-4a62-3960-b2e5-c52091669d6b","vulnerability":{"id":"GHSA-2m9v-5q2g-58vq","description":"Gitea: Git LFS object reuse allows non-Code access to authorize private source objects","datePublished":"Jul 21, 2026, 8:29:43 PM","dateUpdated":"Jul 21, 2026, 8:29:43 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2m9v-5q2g-58vq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28740\nhttps://github.com/go-gitea/gitea/pull/38050\nhttps://github.com/go-gitea/gitea/commit/1c7b7ea72df7cf81e88b8e09049608254d32e56e\nhttps://github.com/go-gitea/gitea/commit/7b4a1a1a118501b9d0260301dfed7f52dfc36ee9\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\n","enisa_id":"EUVD-2026-41643\n","aliases":"GHSA-2m9v-5q2g-58vq\nCVE-2026-28740\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"aa0d922a-f38d-311a-b852-686ef47ce757","vulnerability":{"id":"CVE-2026-28740","description":"Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.","datePublished":"Jul 3, 2026, 8:19:39 PM","dateUpdated":"Jul 7, 2026, 4:58:26 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2m9v-5q2g-58vq\nhttps://github.com/go-gitea/gitea/pull/38050\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","enisa_id":"EUVD-2026-41643\n","assigner":"Gitea","epss":0.32,"dataProcessed":"Nov 2, 2026, 7:20:56 AM","vulnerabilityProduct":[{"id":"20ede53f-aab3-3932-bfa7-75ba5f3d4b9f","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.2"}],"vulnerabilityVendor":[{"id":"5bbd6ad0-e974-3195-a0bd-ffbc6a7d1745","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}