What is the CVSS score of CVE-2026-20912?

CVE-2026-20912 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gitea are affected by CVE-2026-20912?

A critical vulnerability in Gitea allows attackers to bypass access controls and expose sensitive files from private repositories by linking them to public releases.. A patch is available.

How to fix or mitigate CVE-2026-20912?

Within 24 hours: Identify all Gitea instances in your environment and assess whether attachments have been linked across repositories. Within 7 days: Apply the available vendor patch to all affected Gitea instances and validate the update in a staging environment first. Within 30 days: Conduct a security audit of all repository attachments to identify any unauthorized cross-repository links and review access logs for suspicious activity.

Gitea CVE-2026-20912

CRITICAL

Improper Access Control (CWE-284)

2026-01-22 88ee5874-cf24-4952-aea0-31affedb7ff2

GHSA-4xx9-vc8v-87hv

Authentication Bypass Gitea Red Hat Suse

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE

CRITICAL

qualitative

Red Hat

9.1 CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 29, 2026 - 22:03 nvd

Patch available

CVE Published

Jan 22, 2026 - 22:16 nvd

CRITICAL 9.1

DescriptionCVE.org

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

AnalysisAI

Gitea fails to validate repository ownership when linking attachments to releases, allowing users to attach files from one repository to releases in another.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Upload attachment to private repository

Exploit

Craft request linking attachment to public repository release

Execution

Access private attachment via public release URL

Impact

Retrieve sensitive file content

Access

Upload attachment to private repository

Exploit

Craft request linking attachment to public repository release

Execution

Access private attachment via public release URL

Impact

Retrieve sensitive file content

Vulnerability AssessmentAI

Exploitation	Gitea instance with both private and public repositories. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 9.1 with patch. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker uploads a malicious binary to their own repository, then links it to a popular project's release. Users downloading the release get the attacker's malicious file instead of the legitimate artifact.
Remediation	Update Gitea. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all Gitea instances in your environment and assess whether attachments have been linked across repositories. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-28737 HIGH This Week

8.7 Jun 17

Stored cross-site scripting in Gitea 1.25.x affects the built-in 3D file viewer (Online3DViewer integration) where a cra

CVE-2026-26231 HIGH This Week

8.5 Jun 16

Authorization bypass in Gitea versions up to and including 1.26.1 allows any authenticated user with mere read access to

CVE-2026-28699 HIGH This Week

8.1 Jun 16

OAuth2 scope enforcement bypass in Gitea <= 1.26.1 allows any OAuth2 access token to perform write actions far beyond it

CVE-2026-28744 HIGH This Week

8.1 Jun 16

Authorization scope bypass in Gitea v1.26.1 and earlier allows authenticated users to use OAuth2/PAT Bearer tokens to pe

CVE-2026-24791 HIGH This Week

8.1 Jun 17

Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-20912 vulnerability details – vuln.today

Back

Gitea CVE-2026-20912

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More from same product – last 7 days

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code