A malformed SSH sub‑verb in Git Large File Storage requests bypasses Gitea’s authentication checks, permitting anyone who can reach the LFS endpoint to read the full contents of private repositories. The weakness is an Authentication Bypass (CWE‑287) that directly violates confidentiality, allowing sensitive source code and binary data to be disclosed to unauthenticated actors.

The vulnerability impacts installations of the Gitea Open Source Git Server. Advisories reference releases 1.26.3 and 1.26.4, indicating that these versions or those built similarly are affected; no other vendors or products are listed and no additional precise version range is supplied.

The CVSS score of 7.7 classifies the flaw as high severity, and the EPSS score of less than 1 % indicates a very low but non‑zero chance of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker would craft SSH traffic containing an unexpected sub‑verb and send it to the LFS endpoint. Because the attack only requires network connectivity to the SSH service, any host that can reach the server can abuse the flaw, making this a significant confidentiality risk for affected installations.