CVE-2026-120725 | Gitea up to 28.3.x Git LFS endpoint missing authentication

November 15, 2026 Yanac

A vulnerability identified as problematic has been detected in Gitea up to 28.3.x. This issue affects some unknown processing of the component Git LFS endpoint. This manipulation causes missing authentication.

This vulnerability is handled as CVE-2026-120725. The attack can be initiated remotely. There is not any exploit available.

You should upgrade the affected component.VulDB Recent EntriesRead More