CVE-2026-20912: Gitea does not properly validate… – CVSS 9.1 · Watchpost

← All vulnerabilities

Gitea does not properly validate repository ownership when linking attachments to releases

심각 9.1CVE-2026-20912 · BIT-gitea-2026-20912 · GHSA-4xx9-vc8v-87hv · Published 22/01/2026 · updated 15/07/2026

요약

CVE-2026-20912은(는) code.gitea.io/gitea, github.com/go-gitea/gitea, gitea (gitea)에 영향을 주는 심각 (CVSS 9.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.46%, 전체 취약점의 39.5%보다 높음.
조치: 1.25.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
code.gitea.io/gitea Go	`< 1.25.4`	`1.25.4`
github.com/go-gitea/gitea Go	`< 1.25.4`	`1.25.4`
gitea gitea	`< 1.25.4`	`1.25.4`

Description

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

NVD description

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

References

nvd.nist.gov/vuln/detail/CVE-2026-20912 · ADVISORY
go-gitea/gitea#36320 · WEB
go-gitea/gitea#36355 · WEB
go-gitea/gitea commit fbea2c6 · WEB
blog.gitea.com/release-of-1.25.4 · WEB
go-gitea/gitea · PACKAGE
go-gitea/gitea release v1.25.4 · WEB
blog.gitea.com/release-of-1.25.4 · Release Notes
go-gitea/gitea security advisory · Broken Link
access.redhat.com/security/cve/CVE-2026-20912
bugzilla.redhat.com/show_bug.cgi
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20912.json
GitHub Advisory GHSA-4xx9-vc8v-87hv · ADVISORY

code.gitea.io/gitea의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free