CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation (CVE-2026-58435) affects Gitea prior to patch in 1.25.5, per advisory GHSA-rh79-75qm-gwjr. Root cause: when a write deploy key authenticates over SSH, the code sets UserID to the repo owner and embeds this into the LFS JWT, then cross-repo access decision...

CVE-2026-58435

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:29+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-rh79-75qm-gwjr...