CVE-2026-20912

Summary

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

Affected Software

Weaknesses

• CWE-284: CWE-284: Improper Access Control
• CWE-639: CWE-639: Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

gitea: Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

Additional References

• https://access.redhat.com/security/cve/CVE-2026-20912
• https://bugzilla.redhat.com/show_bug.cgi?id=2432219
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20912.json

References

• https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw
• https://github.com/go-gitea/gitea/pull/36320
• https://github.com/go-gitea/gitea/pull/36355
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4
• https://blog.gitea.com/release-of-1.25.4/

• ←Previous
• Next→