PT-2026-4287 · Gitea+1 · Gitea+1

Spingarbor · Published 2026-01-22 · Updated 2026-02-24 · CVE-2026-20736

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Gitea does not correctly validate the repository context during attachment deletion. A user who uploaded an attachment to a repository might be able to delete it even after losing access to that repository by submitting the request through a different repository they are authorized to access. This occurs because the system fails to properly confirm the user's permission to delete the attachment within the original repository.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-GITEA-2026-20736

CVE-2026-20736

GHSA-HGR3-X44X-33HX

GHSA-JR6H-PWWP-C8G6

GO-2026-4367

SUSE-SU-2026:0403-1

Affected Products

Gitea

Red Os

References · 94

• https://github.com/go-gitea/gitea/pull/36320 · Patch
• https://github.com/go-gitea/gitea/security/advisories/GHSA-jr6h-pwwp-c8g6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2026-20736 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hgr3-x44x-33hx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20736 · Security Note
• https://osv.dev/vulnerability/GO-2026-4367 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-20736 · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/commit/fbea2c68e8df11cfa94e8ead913b79946780ed30 · Note
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 · Note
• https://suse.com/security/cve/CVE-2026-24514 · Note
• https://github.com/advisories/GHSA-hgr3-x44x-33hx · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2026-25145 · Note