CVE Catalog
CVE-2026-20750
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.39%
31th percentile - higher than 31% of all known CVEs
Summary
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.
Risk Assessment
Risk of unauthorized access to project data across organizations, potentially leading to information disclosure or unauthorized modifications.
Recommendation
Immediately update Gitea to the latest patched version and review organization permission configurations.
Original NVD description (English source)
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.