CVE-2026-20912
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability in Gitea allows improper validation of repository ownership when linking attachments to releases. An attachment uploaded to a private repository could be linked to a release in a different public repository, making it accessible to unauthorized users.
Risk Assessment
The risk involves potential leakage of sensitive data from private repositories to public ones, compromising project confidentiality and allowing unauthorized access to protected files.
Recommendation
It is recommended to immediately update Gitea to the latest patched version and verify access permission configurations for repositories and attachments.
Original NVD description (English source)
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.