CVE-2026-20750: 
Gitea vulnerability analysis and mitigation

CVE-2026-20750 is an improper access control vulnerability in Gitea that allows authenticated users with project write access in one organization to modify projects belonging to a different organization. It affects all Gitea versions before 1.25.4 (Go module github.com/go-gitea/gitea). The vulnerability was published on January 22, 2026, with the GitHub Advisory Database entry added on January 23, 2026. The Feedly intelligence data assigns a CVSS v3.1 base score of 9.1 (Critical), while the GitHub Advisory rates it as Moderate with a CVSS v4.0 score of 5.3, reflecting differing scoring methodologies (GitHub Advisory, Gitea Release).

The root cause is improper access control (CWE-284) in Gitea's organization project operation handlers, specifically in routers/web/org/projects.go. The application fails to validate that the target project belongs to the same organization as the authenticated user's write access scope, allowing cross-organization project manipulation via crafted web requests. The fix was implemented in pull requests #36318 (main branch) and #36373 (backport to release/v1.25), merged on January 14, 2026, by Gitea maintainer lunny (PR #36318, PR #36373).

Successful exploitation allows an authenticated attacker with project write access in any organization on a shared Gitea instance to modify projects — including their contents, configurations, and settings — belonging to other organizations without authorization. This primarily affects data integrity across organizational boundaries, with potential confidentiality impact if project data is exposed during manipulation. Availability is not directly impacted, but unauthorized modifications could disrupt project workflows and introduce malicious changes to other organizations' project tracking data (GitHub Advisory).

There is no public proof-of-concept exploit available and no evidence of in-the-wild exploitation as of the time of reporting (GitHub Advisory). The vulnerability requires an authenticated user account with project write access in at least one organization on the target Gitea instance, limiting the attack surface compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.017–0.021% (6th percentile), indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a shared Gitea instance running a version prior to 1.25.4. Obtain or register a user account with project write access in at least one organization on the instance.
2. Enumerate target organizations: Browse or query the Gitea API to identify other organizations and their projects on the same instance.
3. Craft malicious request: Construct an HTTP request targeting organization project operation endpoints (e.g., project edit/update routes under /org/<target-org>/projects/) while authenticated as a user with write access only in a different organization.
4. Submit cross-organization request: Send the crafted request referencing a project ID belonging to the target organization. Due to missing ownership validation, the server processes the request without verifying the project belongs to the authenticated user's organization.
5. Achieve unauthorized modification: The target organization's project data (title, description, columns, settings) is modified without authorization, potentially disrupting workflows or introducing malicious content (PR #36318, GitHub Advisory).

• Logs: Gitea access logs showing authenticated requests to organization project endpoints (e.g., /org/<org-name>/projects/<id>) where the requesting user's organization membership does not match the target organization in the URL.
• Logs: Unexpected project modification events in Gitea audit logs attributed to users who are not members of the affected organization.
• Application Data: Unexplained changes to project titles, descriptions, board columns, or settings in organizations where no authorized member performed modifications.
• Network: API or web requests from authenticated sessions targeting project IDs across multiple different organizations in rapid succession, suggesting enumeration or bulk tampering.

Upgrade Gitea to version 1.25.4 or later, which includes the fix for this vulnerability via pull requests #36318 and #36373. Gitea Cloud instances are automatically upgraded during the scheduled maintenance window (Gitea Release). For organizations unable to patch immediately, implement network-level access controls to restrict which users can interact with organization project endpoints, and conduct a security audit of project modification logs to identify any unauthorized cross-organization changes. Restricting user account creation and organization membership on shared instances also reduces the attack surface (GitHub Advisory).

The Gitea project released version 1.25.4 on January 22, 2026, explicitly listing this fix as a security item in the release notes (Gitea Release). The release received positive community engagement on GitHub with over 40 reactions. The vulnerability was also flagged by the Go vulnerability database (GoVulnBot) in golang/vulndb#4370. Coverage appeared on security aggregators and social platforms including Bluesky and Mastodon shortly after disclosure, though no major independent security research commentary has been published.