PT-2026-4294 · Gitea+1 · Gitea+1

Spingarbor · Published 2026-01-22 · Updated 2026-02-24 · CVE-2026-20912

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The software does not correctly check ownership of repositories when managing attachments linked to releases. This can lead to a situation where an attachment from a private repository is incorrectly associated with a release in a public repository, potentially exposing the attachment to unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

BIT-GITEA-2026-20912

CVE-2026-20912

GHSA-4XX9-VC8V-87HV

GHSA-VFMV-F93V-37MW

GO-2026-4364

SUSE-SU-2026:0403-1

Affected Products

Gitea

Red Os

References · 96

• https://github.com/go-gitea/gitea/pull/36355 · Patch
• https://github.com/go-gitea/gitea/pull/36320 · Patch
• https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4364 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-20912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20912 · Security Note
• https://osv.dev/vulnerability/GHSA-4xx9-vc8v-87hv · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2026-20912 · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/commit/fbea2c68e8df11cfa94e8ead913b79946780ed30 · Note
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 · Note
• https://blog.gitea.com/release-of-1.25.4 · Note
• https://suse.com/security/cve/CVE-2026-23990 · Note
• https://twitter.com/TheHackerWire/status/2014854837897490694 · Twitter Post