CVE-2026-20912
📋 TL;DR
Gitea versions before 1.25.4 have an improper access control vulnerability where attachments uploaded to private repositories can be linked to releases in public repositories. This allows unauthorized users to access private files that should remain restricted. All Gitea instances running vulnerable versions are affected.
💻 Affected Systems
- Gitea
📦 What is this software?
Gitea by Gitea
⚠️ Risk & Real-World Impact
Worst Case
Sensitive files from private repositories are exposed to the public internet, potentially leaking confidential data, intellectual property, or credentials.
Likely Case
Accidental or targeted exposure of private repository attachments through public releases, leading to data leakage.
If Mitigated
Minimal impact if proper network segmentation and access controls limit exposure, but still violates repository isolation principles.
🎯 Exploit Status
Exploitation requires authenticated user access to upload attachments, but the vulnerability allows cross-repository linking that bypasses intended access controls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.25.4
Vendor Advisory: https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw
Restart Required: Yes
Instructions:
1. Backup your Gitea instance and database. 2. Download Gitea 1.25.4 from official releases. 3. Stop Gitea service. 4. Replace binary with new version. 5. Restart Gitea service. 6. Verify version and functionality.
🔧 Temporary Workarounds
Disable release attachments
allTemporarily disable the ability to attach files to releases to prevent exploitation.
# Modify app.ini to disable attachments
[attachment]
ENABLED = false
🧯 If You Can't Patch
- Restrict user permissions to prevent unauthorized users from creating releases or uploading attachments.
- Implement network-level controls to limit access to Gitea instance and monitor for suspicious attachment linking activity.
🔍 How to Verify
Check if Vulnerable:
Check Gitea version via web interface admin panel or run: ./gitea --versionCheck Version:
./gitea --versionVerify Fix Applied:
Confirm version is 1.25.4 or later and test that private repository attachments cannot be linked to public releases.📡 Detection & Monitoring
Log Indicators:
- Unusual cross-repository attachment linking events
- Multiple failed access attempts to private attachments from unauthorized users
Network Indicators:
- Unexpected downloads of private repository attachments from public IPs
SIEM Query:
source="gitea.log" AND ("attachment" AND "release" AND "repository")