Gitea LFS deploy‑key functionality contains a flaw that allows certain users to achieve higher privileges than intended. The vulnerability stems from insecure management of deploy‑key credentials and the inability to enforce scope restrictions, enabling an attacker who can create or modify a deploy key to access or modify data beyond their granted rights. This could result in unauthorized code changes, secret exposure, or full repository takeover.

The issue affects Gitea Open Source Git Server versions released prior to the 1.27.0 update. Systems running older releases should be considered vulnerable until the fix is applied.

Because the flaw relies on the deploy‑key mechanism, the likely attack vector is via an authenticated session that has the ability to create or manage deploy keys. The EPSS score of <1% indicates a low but non‑zero likelihood of exploitation, and the CVSS score of 5.4 reflects a moderate severity. The vulnerability is not listed in CISA's KEV catalog. An attacker needs legitimate repository access or the ability to add a deploy key to exploit the weakness; after which elevated privileges can be leveraged to read or modify data that should be restricted.