Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gitea |
|
No data.
No data.
References
History
Fri, 23 Jan 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Gitea
Gitea gitea |
|
| Vendors & Products |
Gitea
Gitea gitea |
Thu, 22 Jan 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users. | |
| Title | Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure | |
| Weaknesses | CWE-284 CWE-639 |
|
| References |
|
MITRE
Status: PUBLISHED
Assigner: Gitea
Published: 2026-01-22T22:01:52.026Z
Updated: 2026-01-22T22:01:52.026Z
Reserved: 2026-01-08T23:02:37.548Z
Link: CVE-2026-20912
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-22T22:16:19.297
Modified: 2026-01-22T22:16:19.297
Link: CVE-2026-20912
Redhat
No data.