CVE-2026-20912

Katalog CVE

CVSS 9.1 · Critical EPSS 0,46%

Kerentanan Improper Access Control pada gitea. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

Rincian

Terbit di NVD

22 Januari 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-283: Unverified Ownership

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-gitea/gitea/pull/36320 issue tracking · patch
• https://github.com/go-gitea/gitea/pull/36355 issue tracking · patch
• https://blog.gitea.com/release-of-1.25.4/ release notes
• https://github.com/go-gitea/gitea/releases/tag/v1.25.4 release notes
• https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw broken link
• https://access.redhat.com/security/cve/CVE-2026-20912
• https://bugzilla.redhat.com/show_bug.cgi?id=2432219
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20912.json