CVE-2026-58435 in Gitea
Summary
by MITRE • 08/13/2026
Gitea LFS Deploy-Key Privilege Escalation
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The Gitea Git server implementation contains a critical privilege escalation vulnerability affecting its Large File Storage (LFS) functionality when utilizing deploy keys for authentication. This vulnerability stems from improper access control mechanisms within the LFS server component that fails to properly validate user permissions when processing requests authenticated via deploy keys. The flaw exists in the authorization logic that does not adequately verify whether the deploy key owner has appropriate privileges to access or modify specific repository resources through the LFS interface.
The technical implementation of this vulnerability manifests when a malicious actor with a deploy key can bypass normal permission checks and gain elevated access to repository resources beyond what their deploy key should permit. This occurs because the LFS server component does not properly correlate the deploy key authentication context with repository-level permissions, allowing arbitrary file operations that should be restricted. The vulnerability is particularly dangerous as it leverages the trust model inherent in deploy keys, which are designed to provide limited access to repositories while maintaining security boundaries.
This privilege escalation vulnerability directly impacts the integrity and confidentiality of repository data by enabling unauthorized modification, deletion, or access to sensitive files stored within LFS. Attackers can exploit this flaw to gain read access to files they should not be authorized to view, write to repositories they do not own, or even execute destructive operations against repository contents. The operational impact extends beyond simple data compromise as it undermines the fundamental security model of Gitea's deploy key system, potentially allowing attackers to establish persistent access to multiple repositories within an organization's infrastructure.
The vulnerability aligns with CWE-285, which addresses improper authorization issues in software systems, and maps to ATT&CK technique T1078 for valid accounts and privilege escalation. Organizations using Gitea with LFS functionality should immediately implement mitigations including updating to patched versions, reviewing deploy key configurations, and monitoring for unauthorized access attempts. Additional protections include implementing network-level restrictions on LFS endpoints, enforcing stricter repository access controls, and conducting regular security audits of authentication mechanisms. The patch resolution typically involves strengthening permission validation logic within the LFS server component to ensure proper correlation between deploy key authentication context and repository resource access rights.
The broader implications for software supply chain security are significant as this vulnerability could enable attackers to compromise not just individual repositories but entire development workflows where Gitea serves as a central code hosting platform. This makes it particularly concerning for organizations relying on automated deployment pipelines that utilize deploy keys for LFS operations, as the attack surface expands beyond traditional repository access to include continuous integration and delivery systems that depend on secure artifact management.