CVE-2026-20750

Katalog CVE

CVSS 9.1 · Critical EPSS 0,44%

Kerentanan Improper Access Control pada gitea. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.

Rincian

Terbit di NVD

22 Januari 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-gitea/gitea/pull/36318 issue tracking · patch
• https://github.com/go-gitea/gitea/pull/36373 issue tracking · patch
• https://blog.gitea.com/release-of-1.25.4/ release notes
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 release notes
• https://github.com/go-gitea/gitea/security/advisories/GHSA-h4fh-pc4w-8w27 broken link
• https://access.redhat.com/security/cve/CVE-2026-20750
• https://bugzilla.redhat.com/show_bug.cgi?id=2432216
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20750.json