CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435

Gitea's LFS server is vulnerable to a privilege escalation flaw due to a trust-boundary confusion in how it handles deploy keys . The system incorrectly sets the UserID in LFS JWT tokens to the repository owner's ID rather than the specific deploy key's identity. Consequently, an attacker possess...

CVE-2026-58435

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:29+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-rh79-75qm-gwjr...