CVE-2026-20897: Gitea authorization bypass in Git LFS lock deletion

CVE-2026-20897 · Severity: critical · CVSS 9.1 · Published 2026-01-22

Gitea, an open-source Git service, contains a security flaw in how it manages file locks for Large File Storage (LFS). An authorized user with write access to one repository can delete file locks in other repositories they do not own. This could disrupt development workflows by allowing unauthorized users to unlock and modify files that other teams are currently working on.

Technologies: Gitea, code.gitea.io/gitea (Go), github.com/go-gitea/gitea (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-20897 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20897 being exploited in the wild.
How severe is CVE-2026-20897?
Critical severity, with a CVSS score of 9.1, published 22 January 2026.
Which products and versions are affected?
Gitea < 1.25.4; code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.25.4; github.com/go-gitea/gitea (Go) SEMVER:introduced=0,fixed=1.25.4.
Is there a fix for CVE-2026-20897?
Yes. code.gitea.io/gitea (Go): upgrade to 1.25.4 or later; github.com/go-gitea/gitea (Go): upgrade to 1.25.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20897 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-20897?
Check whether you run Gitea, code.gitea.io/gitea (Go) or github.com/go-gitea/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • code.gitea.io/gitea (Go): upgrade to 1.25.4 or later
    go get code.gitea.io/gitea@v1.25.4
  • github.com/go-gitea/gitea (Go): upgrade to 1.25.4 or later
    go get github.com/go-gitea/gitea@v1.25.4

Technical details

An authorization bypass vulnerability (CWE-639/CWE-284) exists in Gitea's Git LFS (Large File Storage) implementation. The application fails to verify that a requested LFS lock deletion belongs to the repository context in which the request is made. An attacker with write permissions to at least one repository on the instance can craft requests to delete LFS locks associated with any other repository. This vulnerability was addressed by ensuring LFS lock operations are strictly scoped to the intended repository. The fix is available in Gitea version 1.25.4.

Affected products

  • Gitea Gitea Open Source Git Server < 1.25.4
  • Red Hat OpenShift Pipelines 1

Identifiers

  • CVE-2026-20897
  • GHSA-393c-qgvj-3xph
  • GO-2026-4363

Timeline

  • 2026-01-11: patched: Initial fix merged into main branch
  • 2026-01-22: advisory: NVD and Gitea release advisory published
  • 2026-01-22: patched: Gitea version 1.25.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.