CVE-2026-20736
Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.
| CWE | CWE-284 |
| Vendor | gitea |
| Product | gitea open source git server |
| Published | Jan 22, 2026 |
| Last Updated | Jun 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for gitea gitea open source git server
Be the first to know when new high vulnerabilities affecting gitea gitea open source git server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Gitea / Gitea Open Source Git Server
0 ≤ 1.25.3
References
github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-jr6h-pwwp-c8g6 github.com: https://github.com/go-gitea/gitea/pull/36320 github.com: https://github.com/go-gitea/gitea/releases/tag/v1.25.4 blog.gitea.com: https://blog.gitea.com/release-of-1.25.4/ access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-20736 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2432205 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20736.json
Credits
🔍 spingARbor