Executive brief
Gitea, an open-source platform for hosting software development projects, was found to have a security flaw in how it handles file attachments for software releases. This vulnerability allows an attacker to link a file from a private, restricted repository to a public one, potentially exposing sensitive internal code or data to unauthorized users. Organizations using Gitea should update to version 1.25.4 to ensure private files remain protected.
Technical details
An authorization bypass vulnerability exists in Gitea due to improper validation of repository ownership when linking attachments to releases. The flaw, classified under CWE-284 and CWE-639, allows an attacker to associate an attachment originally uploaded to a private repository with a release in a different, potentially public repository. This occurs because the application does not verify that the attachment and the release belong to the same repository context. An unauthenticated or low-privileged attacker can exploit this to leak sensitive files. The issue is addressed in Gitea version 1.25.4 by implementing stricter ownership checks in the attachment deletion and linking logic.
Affected products
- Gitea Gitea < 1.25.4
- Red Hat OpenShift Pipelines 1
Timeline
- 2026-01-07: other: Initial fix developed in Gitea pull request #36320
- 2026-01-22: advisory: Gitea 1.25.4 released with security fixes
- 2026-01-22: disclosed: CVE-2026-20912 published
References
- https://blog.gitea.com/release-of-1.25.4/
- https://github.com/go-gitea/gitea/pull/36320
- https://github.com/go-gitea/gitea/pull/36355
- https://github.com/go-gitea/gitea/releases/tag/v1.25.4
- https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw
- https://access.redhat.com/security/cve/CVE-2026-20912
- https://bugzilla.redhat.com/show_bug.cgi?id=2432219