GHSA-hgr3-x44x-33hx

Gitea has improper access control for uploaded attachments

Source: GitHub Advisory Database (reviewed) Low CVE-2026-20736

Packages

Ecosystem	Package	Affected	Fixed in
Go	code.gitea.io/gitea	< 1.25.4	1.25.4

Details

As written in the advisory (Markdown source, shown as plain text).

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-20736 advisory
https://github.com/go-gitea/gitea/pull/36320 web
https://github.com/go-gitea/gitea/commit/fbea2c68e8df11cfa94e8ead913b79946780ed30 web
https://blog.gitea.com/release-of-1.25.4 web
https://github.com/go-gitea/gitea package
https://github.com/go-gitea/gitea/releases/tag/v1.25.4 web