| Package | Affected versions | Patched versions |
|---|---|---|
| code.gitea.io/gitea | < 1.25.4 | 1.25.4 |
| github.com/go-gitea/gitea | < 1.25.4 | 1.25.4 |
| gitea | < 1.25.4 | 1.25.4 |
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free