CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation (CVE-2026-58435) is rooted in a trust-boundary flaw where a deploy key’s authentication JWT embeds the repository owner's UserID. The LFS server then uses this UserID to perform cross-repo access checks via LFSObjectAccessible(), enabling an attacker with...