CVE-2026-28740 affects Gitea Open Source Git Server versions up to 1.26.2. The vulnerability involves improper authorization checks related to Git LFS object reuse, allowing users with repository access but without Code-unit access to gain unauthorized access to private source objects. This is a case of authorization bypass due to insufficient validation of user permissions when reusing Git LFS objects. The CVSS 3.1 base score is 7.1, indicating a high severity issue with network attack vector, high attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact, limited integrity impact, and no availability impact. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

The vulnerability allows unauthorized access to private source objects by users who should not have Code-unit access, potentially leading to exposure of sensitive code or data. The confidentiality impact is high, integrity impact is low, and availability is not affected. This could result in information disclosure within affected Gitea repositories.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor Gitea vendor communications for updates. Until a fix is available, restrict repository access to trusted users and consider additional access controls or auditing to mitigate unauthorized access risks.