Vulnerability advisory
GHSA-hgr3-x44x-33hx
Gitea has improper access control for uploaded attachments
Also known as BIT-gitea-2026-20736CVE-2026-20736GHSA-jr6h-pwwp-c8g6GO-2026-4367
Severity
- CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 1.25.4 | 1.25.4 |
Description
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.