Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit…

CVE-2026-28740 affects Gitea versions up to and including 1.26.2, where a flaw in Git LFS object reuse allows unauthorized access to private source objects. Users who have repository access but lack Code-unit access can exploit this vulnerability to view private LFS objects they should not be permitted to access. The issue stems from improper authorization checks during LFS object reuse operations. Gitea has released versions 1.26.3 and 1.26.4 to address this vulnerability. A security advisory has been published on GitHub alongside a pull request detailing the fix. Users are strongly advised to upgrade to the patched versions immediately to prevent potential unauthorized data exposure.