CVE-2026-20736: Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/code.gitea.io/giteato a version that resolves this vulnerability.Fixed in 1.25.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20736?
CVE-2026-20736 has a medium severity rating due to its potential to allow unauthorized access to sensitive attachments.
How do I fix CVE-2026-20736?
To remediate CVE-2026-20736, update Gitea to version 1.25.4 or later.
What is the impact of CVE-2026-20736?
CVE-2026-20736 allows users to delete attachments from repositories they no longer have access to, potentially leading to data loss.
Who is affected by CVE-2026-20736?
Users of Gitea prior to version 1.25.4 are at risk of CVE-2026-20736.
Can CVE-2026-20736 affect multiple repositories?
Yes, CVE-2026-20736 can lead to unauthorized deletion of attachments across different repositories if the user has previously uploaded content.