CVE-2026-120725

Gitea anonymous Git LFS access despite required sign-in

View on CVE.org
Published Nov 15, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
With `REQUIRE_SIGNIN_VIEW = true`, the Git LFS endpoints still answered unauthenticated requests for repositories that are not private. An anonymous client who knows the path of such a repository and the SHA-256 of an LFS object could download the object, and could use the batch endpoint to test whether an object exists. The Git LFS endpoints now require authentication when sign-in is required to view the instance.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description With `REQUIRE_SIGNIN_VIEW = true`, the Git LFS endpoints still answered unauthenticated requests for repositories that are not private. An anonymous client who knows the path of such a repository and the SHA-256 of an LFS object could download the object, and could use the batch endpoint to test whether an object exists. The Git LFS endpoints now require authentication when sign-in is required to view the instance.
Title Gitea anonymous Git LFS access despite required sign-in
Weaknesses CWE-306
References

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
Gitea
Published
Updated
Nov 15, 2026, 9:13 PM
Reserved
Nov 15, 2026, 8:31 PM

View source JSON

No data.

No data.

No data.

No data.