CVE-2026-20912: Gitea improper ownership validation in release attachments

CVE-2026-20912 · Severity: critical · CVSS 9.1 · Published 2026-01-22

Gitea, an open-source platform for hosting software development projects, was found to have a security flaw in how it handles file attachments for software releases. This vulnerability allows an attacker to link a file from a private, restricted repository to a public one, potentially exposing sensitive internal code or data to unauthorized users. Organizations using Gitea should update to version 1.25.4 to ensure private files remain protected.

Technologies: Gitea, code.gitea.io/gitea (Go), github.com/go-gitea/gitea (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-20912 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20912 being exploited in the wild.
How severe is CVE-2026-20912?
Critical severity, with a CVSS score of 9.1, published 22 January 2026.
Which products and versions are affected?
Gitea < 1.25.4; code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.25.4; github.com/go-gitea/gitea (Go) SEMVER:introduced=0,fixed=1.25.4.
Is there a fix for CVE-2026-20912?
Yes. code.gitea.io/gitea (Go): upgrade to 1.25.4 or later; github.com/go-gitea/gitea (Go): upgrade to 1.25.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20912 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20912?
Check whether you run Gitea, code.gitea.io/gitea (Go) or github.com/go-gitea/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • code.gitea.io/gitea (Go): upgrade to 1.25.4 or later
    go get code.gitea.io/gitea@v1.25.4
  • github.com/go-gitea/gitea (Go): upgrade to 1.25.4 or later
    go get github.com/go-gitea/gitea@v1.25.4

Technical details

An authorization bypass vulnerability exists in Gitea due to improper validation of repository ownership when linking attachments to releases. The flaw, classified under CWE-284 and CWE-639, allows an attacker to associate an attachment originally uploaded to a private repository with a release in a different, potentially public repository. This occurs because the application does not verify that the attachment and the release belong to the same repository context. An unauthenticated or low-privileged attacker can exploit this to leak sensitive files. The issue is addressed in Gitea version 1.25.4 by implementing stricter ownership checks in the attachment deletion and linking logic.

Affected products

  • Gitea Gitea < 1.25.4
  • Red Hat OpenShift Pipelines 1

Identifiers

  • CVE-2026-20912
  • GHSA-4xx9-vc8v-87hv
  • GO-2026-4364

Timeline

  • 2026-01-07: other: Initial fix developed in Gitea pull request #36320
  • 2026-01-22: advisory: Gitea 1.25.4 released with security fixes
  • 2026-01-22: disclosed: CVE-2026-20912 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.