Gitea does not properly validate repository ownership when deleting Git LFS locks

CRITICAL 9.1CVE-2026-20897 · BIT-gitea-2026-20897 · GHSA-393c-qgvj-3xph · Published 22/01/2026 · updated 15/07/2026

Package	Affected versions	Patched versions
code.gitea.io/gitea Go	`< 1.25.4`	`1.25.4`
github.com/go-gitea/gitea Go	`< 1.25.4`	`1.25.4`
gitea gitea	`< 1.25.4`	`1.25.4`

Description

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.

NVD description

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.

References

nvd.nist.gov/vuln/detail/CVE-2026-20897 · ADVISORY
go-gitea/gitea#36344 · WEB
go-gitea/gitea#36349 · WEB
go-gitea/gitea commit da036f3 · WEB
blog.gitea.com/release-of-1.25.4 · WEB
go-gitea/gitea · PACKAGE
go-gitea/gitea release v1.25.4 · WEB
blog.gitea.com/release-of-1.25.4 · Release Notes
go-gitea/gitea security advisory · Broken Link
access.redhat.com/security/cve/CVE-2026-20897
bugzilla.redhat.com/show_bug.cgi
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20897.json
GitHub Advisory GHSA-393c-qgvj-3xph · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free