CVE-2026-58435 - Vulnerability Details - OpenCVE

Gitea LFS Deploy-Key Privilege Escalation

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Gitea	Gitea Open Source Git Server

No data.

No data.

References

Link	Providers
https://blog.gitea.com/gitea-1.27.0-is-released/
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-rh79-75qm-gwjr

History

Fri, 14 Aug 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}`

Thu, 13 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Gitea Gitea gitea Open Source Git Server
Vendors & Products		Gitea Gitea gitea Open Source Git Server

Thu, 13 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		Gitea LFS Deploy-Key Privilege Escalation
Title		Gitea LFS Deploy-Key Privilege Escalation
Weaknesses		CWE-266 CWE-639
References		https://blog.gitea.com/gitea-1.27.0-is-released/ https://github.com/go-gitea/gitea/releases/tag/v1.27.0 https://github.com/go-gitea/gitea/security/advisories/GHSA-rh79-75qm-gwjr

MITRE

Status: PUBLISHED

Assigner: Gitea

Published: 2026-08-13T16:44:51.733Z

Updated: 2026-08-14T17:20:22.792Z

Reserved: 2026-06-30T18:57:20.616Z

Link: CVE-2026-58435

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-08-13T17:17:27.490

Modified: 2026-08-26T16:53:48.300

Link: CVE-2026-58435

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58435", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-06-30T18:57:20.616Z", "datePublished": "2026-08-13T16:44:51.733Z", "dateUpdated": "2026-08-14T17:20:22.792Z"}, "containers": {"cna": {"title": "Gitea LFS Deploy-Key Privilege Escalation", "descriptions": [{"lang": "en", "value": "Gitea LFS Deploy-Key Privilege Escalation"}], "affected": [{"vendor": "Gitea", "product": "Gitea Open Source Git Server", "versions": [{"version": "0", "lessThanOrEqual": "1.26.4", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "CWE-266", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "description": "CWE-639", "lang": "en", "type": "CWE"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rh79-75qm-gwjr", "name": "GitHub Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0", "name": "Gitea v1.27.0 Release", "tags": ["release-notes"]}, {"url": "https://blog.gitea.com/gitea-1.27.0-is-released/", "name": "Gitea v1.27.0 Release Blog Post", "tags": ["release-notes"]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-08-13T16:44:51.733Z"}, "credits": [{"lang": "en", "value": "adrian-doyensec", "type": "reporter"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rh79-75qm-gwjr", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T17:20:18.791594Z", "id": "CVE-2026-58435", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T17:20:22.792Z"}}]}}