CVE-2026-20912: Gitea Improper Repository Ownership Validation in Release Attachments
Summary
CVE-2026-20912: Gitea does not properly validate repository ownership when linking attachments to releases. Affects github.com/go-gitea/gitea versions < 1.25.4. Fixed in 1.25.4. How to fix ↓
Also tracked for
- code.gitea.io/gitea · Go
- gitea · Bitnami
The same CVE-2026-20912 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service that provides a user-friendly interface for managing Git repositories. It allows users to create, manage, and collaborate on projects with features like pull requests, issues, and release management. However, Gitea has a vulnerability that affects how it validates repository ownership when linking attachments to releases, potentially exposing sensitive data.
Vulnerability Detail
Gitea does not properly validate repository ownership when linking attachments to releases. This flaw allows an attachment uploaded to a private repository to be linked to a release in a different public repository, making it accessible to unauthorized users. The vulnerability arises from insufficient checks in the code that handles the attachment linking process, leading to potential data leaks and unauthorized access to sensitive information.
How To Fix
Latest published version: v1.8.3 as of 23 Oct 2026
go get github.com/go-gitea/gitea@v1.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.25.4
This is the first release that contains the fix.
go get github.com/go-gitea/gitea@v1.25.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to their private repositories and avoid linking attachments to releases until the patch is applied. Additionally, consider reviewing the permissions of public repositories to ensure sensitive data is not inadvertently exposed.
Conclusion
The vulnerability CVE-2026-20912 in Gitea poses a significant risk by allowing unauthorized access to attachments linked to releases. Users are strongly encouraged to update to version 1.25.4 or later to protect their repositories. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for github.com/go-gitea/gitea →
FAQ
CVE-2026-20912 is a vulnerability in Gitea that allows improper validation of repository ownership when linking attachments to releases, potentially exposing sensitive data.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The main risk is unauthorized access to sensitive attachments uploaded to private repositories, which could lead to data leaks and compromise user privacy.
Yes, a patch is available in version 1.25.4 of Gitea. Users are advised to update to this version or later to mitigate the vulnerability.
If immediate updating is not possible, restrict access to private repositories and review public repository permissions to minimize exposure until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-gitea/gitea.
