PT-2026-4292 · Gitea+1 · Gitea+1

Spingarbor · Published 2026-01-22 · Updated 2026-02-24 · CVE-2026-20897

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Gitea does not correctly validate repository ownership during the deletion of Git LFS locks. This allows a user with write access to a repository to potentially delete LFS locks that belong to other repositories. The issue involves improper validation when deleting Git LFS locks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

BIT-GITEA-2026-20897

CVE-2026-20897

GHSA-393C-QGVJ-3XPH

GHSA-RRQ5-R9H5-PC7C

GO-2026-4363

SUSE-SU-2026:0403-1

Affected Products

Gitea

Red Os

References · 98

• https://github.com/go-gitea/gitea/pull/36344 · Patch
• https://github.com/go-gitea/gitea/pull/36349 · Patch
• https://github.com/go-gitea/gitea/security/advisories/GHSA-rrq5-r9h5-pc7c · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2026-20897 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4363 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-20897 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20897 · Security Note
• https://osv.dev/vulnerability/GHSA-393c-qgvj-3xph · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/commit/da036f3f35ca830b22cf4480912ed261303b798f · Note
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 · Note
• https://twitter.com/_cvereports/status/2015041969077026878 · Twitter Post
• https://blog.gitea.com/release-of-1.25.4 · Note
• https://suse.com/security/cve/CVE-2026-23990 · Note