CVE Catalog
CVE-2026-20897
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.42%
34th percentile - higher than 34% of all known CVEs
Summary
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
Risk Assessment
An attacker could disrupt other repositories by deleting their LFS locks, potentially leading to data loss or team workflow interruption.
Recommendation
Immediately update Gitea to a version that includes the fix for repository ownership validation when deleting LFS locks.
Original NVD description (English source)
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.