Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via improper validation of repository ownership when linking attachments to releases. An attacker can gain unauthorized access to attachments by linking an attachment uploaded to a privat...

CVE-2026-20912

Gitea is vulnerable to an authorization bypass because it fails to properly validate repository ownership when linking attachments to releases. An attacker can exploit this by linking an attachment from a private repository to a release in a different public repository , allowing unauthorized use...