GHSA-rw22-5hhq-pfpf

Gitea does not properly validate project ownership in organization project operations

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-20750

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/go-gitea/gitea	< 1.25.4	1.25.4

Details

As written in the advisory (Markdown source, shown as plain text).

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-20750 advisory
https://github.com/go-gitea/gitea/pull/36318 web
https://github.com/go-gitea/gitea/pull/36373 web
https://github.com/go-gitea/gitea/commit/7b5de594cd92e30b9c3d40ffda119acad794cc64 web
https://blog.gitea.com/release-of-1.25.4 web
https://github.com/go-gitea/gitea package
https://github.com/go-gitea/gitea/releases/tag/v1.25.4 web