What is the CVSS score of CVE-2026-20912?

CVE-2026-20912 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gitea are affected by CVE-2026-20912?

A critical vulnerability in Gitea allows attackers to bypass access controls and expose sensitive files from private repositories by linking them to public releases.. A patch is available.

How to fix or mitigate CVE-2026-20912?

Within 24 hours: Identify all Gitea instances in your environment and assess whether attachments have been linked across repositories. Within 7 days: Apply the available vendor patch to all affected Gitea instances and validate the update in a staging environment first. Within 30 days: Conduct a security audit of all repository attachments to identify any unauthorized cross-repository links and review access logs for suspicious activity.

Gitea CVE-2026-20912

CRITICAL

Improper Access Control (CWE-284)

2026-01-22 88ee5874-cf24-4952-aea0-31affedb7ff2

GHSA-4xx9-vc8v-87hv

Authentication Bypass Gitea

9.1

CVSS 3.1 · Vendor: 88ee5874-cf24-4952-aea0-31affedb7ff2

Severity by source

Vendor (88ee5874-cf24-4952-aea0-31affedb7ff2) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE

CRITICAL

qualitative

Red Hat

9.1 CRITICAL

qualitative

Primary rating from Vendor (88ee5874-cf24-4952-aea0-31affedb7ff2).

CVSS VectorVendor: 88ee5874-cf24-4952-aea0-31affedb7ff2

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 29, 2026 - 22:03 nvd

Patch available

CVE Published

Jan 22, 2026 - 22:16 nvd

CRITICAL 9.1

DescriptionCVE.org

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

AnalysisAI

Gitea fails to validate repository ownership when linking attachments to releases, allowing users to attach files from one repository to releases in another.

Technical ContextAI

Gitea does not validate that an uploaded attachment belongs to the same repository as the release being modified (CWE-284), allowing cross-repository attachment linking.

RemediationAI

Update Gitea. Verify release artifact integrity through checksums.

More in Gitea

View all

CVE-2026-60004 CRITICAL Act Now POC

9.8

Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi

CVE-2026-27771 HIGH Act Now POC

8.2 Jul 03

Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r

CVE-2022-30781 HIGH Act Now POC

7.5 May 16

Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp

CVE-2020-14144 HIGH Act Now POC

7.2 Oct 16

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir

CVE-2024-6886 CRITICAL Act Now POC

10.0 Aug 06

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea

CVE-2026-20896 CRITICAL Act Now POC

9.8 Jul 03

Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any

CVE-2026-58053 CRITICAL Act Now POC

9.4 Jun 28

Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec

CVE-2019-11229 HIGH This Week POC

8.8 Apr 15

models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem

CVE-2026-57894 HIGH This Week POC

8.5 Jul 21

Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica

CVE-2026-24791 HIGH This Week POC

8.1 Jun 17

Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran

CVE-2020-13246 HIGH This Week POC

7.5 May 20

An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita

CVE-2022-0905 HIGH This Week POC

7.1 Mar 10

Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab

Same weakness CWE-284 – Improper Access Control

View all

CVE-2012-4681 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2012-5076 CRITICAL POC

9.8

CVE-2014-3120 HIGH POC

8.1

CVE-2013-2423 LOW POC

3.7

CVE-2016-3427 CRITICAL

9.8

CVE-2025-12480 CRITICAL POC

9.1

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-20912 vulnerability details – vuln.today

Back

Gitea CVE-2026-20912

Severity by source

CVSS VectorVendor: 88ee5874-cf24-4952-aea0-31affedb7ff2

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Gitea

Same weakness CWE-284 – Improper Access Control

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code