CVE-2026-20750
📋 TL;DR
Gitea contains an authorization bypass vulnerability where users with project write access in one organization can modify projects belonging to other organizations. This affects all Gitea instances with multiple organizations where users have cross-organization access. The vulnerability allows unauthorized project modifications across organizational boundaries.
💻 Affected Systems
- Gitea
📦 What is this software?
Gitea by Gitea
⚠️ Risk & Real-World Impact
Worst Case
Malicious users could delete, modify, or inject malicious content into projects belonging to other organizations, potentially leading to data loss, code compromise, or supply chain attacks.
Likely Case
Users accidentally or intentionally modifying projects in organizations where they shouldn't have access, causing data integrity issues and unauthorized changes.
If Mitigated
Limited to users who already have some level of access within the Gitea instance, with audit trails potentially capturing unauthorized actions.
🎯 Exploit Status
Exploitation requires authenticated user with project write access in at least one organization. The vulnerability is in authorization logic, making exploitation straightforward for users with some existing privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.25.4
Vendor Advisory: https://github.com/go-gitea/gitea/security/advisories/GHSA-h4fh-pc4w-8w27
Restart Required: Yes
Instructions:
1. Backup your Gitea instance and database. 2. Download Gitea 1.25.4 from official releases. 3. Stop Gitea service. 4. Replace binary with new version. 5. Restart Gitea service. 6. Verify version shows 1.25.4.
🔧 Temporary Workarounds
Restrict User Access
allTemporarily limit user permissions to only essential organizations and review all cross-organization access.
Audit Project Changes
allEnable detailed audit logging and monitor for unauthorized project modifications across organizations.
# In app.ini: [log] LEVEL = Info
# Enable audit logging in Gitea settings
🧯 If You Can't Patch
- Implement strict access controls and review all user permissions across organizations
- Enable comprehensive audit logging and monitor for unauthorized project modifications
🔍 How to Verify
Check if Vulnerable:
Check if Gitea version is below 1.25.4 and instance has multiple organizations with users having cross-organization project write access.Check Version:
./gitea --version or check Gitea web interface admin panelVerify Fix Applied:
After patching, test that users can only modify projects in organizations where they have explicit write permissions.📡 Detection & Monitoring
Log Indicators:
- Unauthorized project modification attempts
- User accessing projects outside their organization
- Failed authorization checks for project operations
Network Indicators:
- Unusual pattern of project API calls across different organizations
SIEM Query:
source="gitea" AND (event="project_modification" OR event="repository_update") AND organization_changed=true