CVE-2026-20897: Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/go-gitea/giteato a version that resolves this vulnerability.Fixed in 1.25.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20897?
CVE-2026-20897 is classified as a high severity vulnerability that involves broken access control in Gitea.
How do I fix CVE-2026-20897?
To fix CVE-2026-20897, upgrade Gitea to version 1.25.4 or later.
What does CVE-2026-20897 affect?
CVE-2026-20897 affects Gitea's Git LFS lock deletion functionality, specifically regarding repository ownership validation.
Who is impacted by CVE-2026-20897?
Users with write access to one repository in Gitea may exploit CVE-2026-20897 to delete Git LFS locks from other repositories.
What is the cause of CVE-2026-20897?
CVE-2026-20897 is caused by Gitea's improper validation of repository ownership when performing delete operations on Git LFS locks.