Junglewise Threat Intelligence

CVE-2026-20897: Gitea authorization bypass in Git LFS lock deletion

CVE-2026-20897 · Severity: critical · CVSS 9.1 · Published 2026-01-22

Technologies: code.gitea.io/gitea (Go), github.com/go-gitea/gitea (Go), Gitea. Vendors: Go, Red Hat, Gitea.

Executive brief

Gitea, an open-source Git service, contains a security flaw in how it manages file locks for Large File Storage (LFS). An authorized user with write access to one repository can delete file locks in other repositories they do not own. This could disrupt development workflows by allowing unauthorized users to unlock and modify files that other teams are currently working on.

Technical details

An authorization bypass vulnerability (CWE-639/CWE-284) exists in Gitea's Git LFS (Large File Storage) implementation. The application fails to verify that a requested LFS lock deletion belongs to the repository context in which the request is made. An attacker with write permissions to at least one repository on the instance can craft requests to delete LFS locks associated with any other repository. This vulnerability was addressed by ensuring LFS lock operations are strictly scoped to the intended repository. The fix is available in Gitea version 1.25.4.

Affected products

  • Gitea Gitea Open Source Git Server < 1.25.4
  • Red Hat OpenShift Pipelines 1

Timeline

  • 2026-01-11: patched: Initial fix merged into main branch
  • 2026-01-22: advisory: NVD and Gitea release advisory published
  • 2026-01-22: patched: Gitea version 1.25.4 released

References

Related threats