CVE-2026-20706

CriticalCVSS 9.1

Published: 03/07/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

A vulnerability in Gitea up to version 1.26.1 allows repository archive downloads to bypass token scope checks on the web archive download endpoint.

Risk Assessment

An attacker can exploit this flaw to download a repository archive without proper authorization, potentially leading to the exposure of sensitive data.

Recommendation

It is recommended to immediately upgrade Gitea to version 1.26.2 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.