CVE-2026-20912: Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/go-gitea/giteato a version that resolves this vulnerability.Fixed in 1.25.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20912?
CVE-2026-20912 has a high severity due to its potential for unauthorized access to private attachment data.
How do I fix CVE-2026-20912?
To mitigate CVE-2026-20912, update Gitea to version 1.25.4 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-20912?
CVE-2026-20912 is a cross-repository authorization bypass vulnerability.
Who is affected by CVE-2026-20912?
CVE-2026-20912 affects users of Gitea that utilize private repositories for their attachments.
What could happen if CVE-2026-20912 is exploited?
Exploitation of CVE-2026-20912 could lead to the disclosure of private attachments linked to releases.