Description

Gitea LFS Deploy-Key Privilege Escalation

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-13T17:17:27.490Z",
  "pubdate": "2026-08-13T17:17:27.490Z",
  "executiveSummary": "A privilege escalation vulnerability exists within the Large File Storage (LFS) implementation in Gitea, specifically involving the misuse or improper handling of deploy-keys. This security flaw allows threat actors or unauthorized users with restricted deploy-key access to bypass intended authorization boundaries and perform operations exceeding their assigned permissions, potentially leading to unauthorized data access, modification, or repository compromise.\nThe vulnerability impacts Gitea instances utilizing Git LFS functionality alongside restricted deploy-keys. The primary risk implication is the erosion of access control enforcement, enabling unauthorized modification of sensitive repository assets. Attackers capable of leveraging restricted deploy-keys can exploit this mechanism to interact with LFS storage endpoints in ways prohibited by the core authorization model.\nExploitation generally requires an entity to possess or control a valid deploy-key associated with a repository. By interacting with the LFS protocol handlers, the actor can trigger the flaw to gain elevated privileges regarding LFS object management. The overall severity warrants immediate attention and remediation through proper access control validation within the LFS subsystem.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient authorization checks within the Gitea LFS subsystem when requests are authenticated via deploy-keys. Specifically, the application fails to adequately validate whether a given deploy-key holds write or administrative permissions specifically required for LFS payload transactions, or incorrectly equates read-only deploy-key contexts with broader repository access capabilities.\nThe vulnerable component resides in the Gitea codebase responsible for processing Git LFS requests—specifically authentication and authorization middleware or controller functions that handle LFS pointer file uploads and downloads. When an LFS HTTP API request is initiated using a deploy-key, the application's permission validation routines fail to restrict the operation according to the deploy-key's configured access mode (read-only versus read-write).\nThe attack flow proceeds as follows: First, an attacker obtains or utilizes a restricted (e.g., read-only) deploy-key assigned to a target Gitea repository. Second, the attacker crafts a malicious LFS API request (such as an upload or batch operation) targeting the repository's LFS endpoint. Third, the attacker authenticates the request using the restricted deploy-key. Fourth, due to flawed permission verification logic within the LFS request handler, Gitea processes the request and grants unauthorized access to perform LFS mutations or exfiltration. Authentication is required in the form of a deploy-key, but the privilege level enforced is improperly elevated due to the validation bypass.\nPost-exploitation impact includes the potential unauthorized injection, modification, or extraction of large binary assets managed by Git LFS within the affected repository. This could facilitate supply chain contamination by replacing legitimate LFS binaries with malicious payloads if write access is improperly granted, or violate confidentiality boundaries if read restrictions are bypassed."
}