PT-2026-4294 · Gitea+1 · Gitea+1

Spingarbor · CVE-2026-20912 · Published 2026-01-22 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The software does not correctly check ownership of repositories when managing attachments linked to releases. This can lead to a situation where an attachment from a private repository is incorrectly associated with a release in a public repository, potentially exposing the attachment to unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

IDOR

Improper Access Control

Weakness Enumeration

CWE-639

CWE-284

CWE-283

Related Identifiers

BIT-GITEA-2026-20912

CVE-2026-20912

GHSA-4XX9-VC8V-87HV

GHSA-VFMV-F93V-37MW

GO-2026-4364

OPENSUSE-SU-2026:21483-1

SUSE-SU-2026:0403-1

Affected Products

Gitea

Red Os

References · 1760

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/20xxx/CVE-2026-20912.json · Exploit
• https://github.com/go-gitea/gitea/pull/36355 · Patch
• https://github.com/go-gitea/gitea/pull/36320 · Patch
• https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4xx9-vc8v-87hv · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20912 · Security Note
• https://osv.dev/vulnerability/BIT-gitea-2026-20912 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-20912 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4364 · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/commit/fbea2c68e8df11cfa94e8ead913b79946780ed30 · Note
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note