Gitea versions up to 1.26.2 allow a Git LFS object reuse flaw that bypasses code‑unit authorization. An attacker who has basic repository read permission but not code‑unit rights can request a previously uploaded LFS file that was owned by a higher‑privileged user. The ownership check for the LFS object identifier is omitted, enabling retrieval of private source objects and leaking confidential content. The weakness is cataloged as CWE‑639 (Missing Access Control) and CWE‑863 (Access Control Failure).

This vulnerability impacts installations of the Gitea Open Source Git Server that run version 1.26.2 or earlier. Versions 1.26.3 and later contain the fix and are not susceptible to the bypass.

The CVSS score of 7.1 reflects a moderate‑to‑high severity. The EPSS score of less than 1% indicates a low but nonzero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires only that the attacker have standard repository read access and that a usable LFS object exists in a repository where higher privileges are available. Based on the description, it is inferred that no special network conditions or local code execution are necessary; the malicious request can be made with standard Git LFS commands over any accessible network.