CVE-2026-20912: 
Gitea vulnerability analysis and mitigation

CVE-2026-20912 is an improper access control vulnerability in Gitea that allows attackers to link attachments uploaded to a private repository to a release in a different public repository, making those attachments accessible to unauthorized users. It affects all Gitea versions prior to 1.25.4. The vulnerability was published on January 22, 2026, with patches merged on January 12, 2026, and the fixed release issued on January 22, 2026. The CVSS v3.1 base score is 9.1 (Critical) per Feedly's assessment, though the GitHub Advisory Database rates it as Moderate (5.1 CVSS v4) (GitHub Advisory, Gitea Release).

The root cause is insufficient validation of repository ownership when linking attachments to releases, classified as CWE-284 (Improper Access Control) and CWE-639 (Authorization Bypass Through User-Controlled Key). When a user uploads an attachment to a private repository and then links it to a release in a different, public repository, Gitea fails to verify that the attachment belongs to the target repository. The fix, implemented in pull requests #36320 and #36355, adjusts the position of the repository ownership check in routers/web/repo/attachment.go and adds corresponding tests (GitHub PR #36320, GitHub Advisory).

Successful exploitation allows unauthorized users to access files and attachments from private repositories by viewing them through a public repository's release page, bypassing all access controls on the private repository. This can expose sensitive project data, credentials, proprietary source code, or other confidential content that was intended to remain private. There is no availability impact, but both confidentiality and integrity are affected, as an attacker can also manipulate which attachments appear in public releases (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017–0.021%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Identify a target Gitea instance: Locate a Gitea deployment running a version prior to 1.25.4 that hosts both private and public repositories.
2. Obtain access to a private repository: The attacker must have at least write access to a private repository (e.g., via a legitimate account or compromised credentials).
3. Upload an attachment to the private repository: Use Gitea's attachment upload functionality to upload a sensitive file (e.g., a configuration file with credentials) to the private repository.
4. Link the attachment to a public repository release: When creating or editing a release in a public repository, reference the attachment UUID/ID from the private repository. Because Gitea does not validate repository ownership at this step, the attachment is accepted.
5. Access the exposed attachment: Any unauthenticated or unauthorized user can now download the private repository's attachment via the public release page, bypassing all private repository access controls (GitHub Advisory, GitHub PR #36320).

• Logs: Gitea access logs showing attachment UUIDs from private repositories being referenced in release creation or edit API calls for public repositories; cross-repository attachment linking events in audit logs.
• Application Behavior: Release pages on public repositories displaying attachments that were originally uploaded to private repositories; unexpected attachment associations visible in release metadata.
• Network: Unusual download requests for attachment files from users who do not have access to the originating private repository.

Upgrade Gitea to version 1.25.4 or later, which includes the fix for this vulnerability via backported pull requests #36320 and #36355. No configuration-based workaround is available; patching is the only remediation. As an interim measure, administrators should review recent release activity and audit attachment associations across repositories with differing visibility levels, and consider restricting write access to sensitive private repositories until the upgrade is applied (Gitea Release, GitHub Advisory).

The Gitea project addressed the vulnerability as part of a broader security-focused patch release (v1.25.4), which included eight security fixes. The release was well-received by the community, with positive reactions on GitHub. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database entries and the official Gitea blog release announcement (Gitea Blog, Gitea Release).