Skip to content
Heist/ feed
Back to feed
Critical

Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

Type: advisorySources: OSV

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-20897
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 11:41 UTC · Revision 1

Source evidence

Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

core-osv · Original source

Published 22 Jan 2026, 22:01 UTC

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.

osv:CVE-2026-20897
Complete source record
{
  "id": "9aa637fccd1b692a1a9de7aba76b3c30cf13c3a3d80250abd95d407ef7678916",
  "url": "https://osv.dev/vulnerability/CVE-2026-20897",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)",
    "summary": "Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.",
    "evidence": "osv:CVE-2026-20897",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-20897",
      "aliases": [
        "BIT-gitea-2026-20897",
        "CVE-2026-20897",
        "GHSA-393c-qgvj-3xph",
        "GHSA-rrq5-r9h5-pc7c",
        "GO-2026-4363"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/go-gitea/gitea",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "369830bada2fd8826a5135cb2fc66660a9bef708"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.25.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "369830bada2fd8826a5135cb2fc66660a9bef708"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.25.4"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.25.3",
            "v1.25.2",
            "v1.25.1",
            "v1.25.0",
            "v1.25.0-rc0",
            "v1.26.0-dev",
            "v1.25.0-dev",
            "v1.24.0-dev",
            "v1.22.0-rc1",
            "v1.23.0-dev",
            "v1.22.0-rc0",
            "v1.21.0-rc0",
            "v1.22.0-dev",
            "v1.20.0-rc0",
            "v1.21.0-dev",
            "v1.20.0-dev",
            "v1.19.0-rc0",
            "v1.18.0-rc0",
            "v1.19.0-dev",
            "v1.18.0-dev",
            "v1.17.0-dev",
            "v1.16.0-rc1",
            "v1.15.0-rc1",
            "v1.16.0-dev",
            "v1.15.0-dev",
            "v1.14.0-dev",
            "v1.13.0-dev",
            "v1.12.0-dev",
            "v1.10.5",
            "v1.11.0-rc1",
            "v1.10.0-rc1",
            "v1.11.0-dev",
            "v1.9.0-rc1",
            "v1.10.0-dev",
            "v1.9.0-dev",
            "v1.7.0-dev",
            "v1.6.0-rc1",
            "v1.6.0-dev",
            "v1.5.0-rc1",
            "v1.5.0-dev",
            "v1.1.0",
            "v1.0.0",
            "v0.9.99"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-20897.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:34.805107896Z",
      "provider": "osv",
      "references": [
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20897.json",
        "https://access.redhat.com/security/cve/CVE-2026-20897",
        "https://blog.gitea.com/release-of-1.25.4/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/20xxx/CVE-2026-20897.json",
        "https://github.com/go-gitea/gitea/releases/tag/v1.25.4",
        "https://github.com/go-gitea/gitea/security/advisories/GHSA-rrq5-r9h5-pc7c",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-20897",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2432204",
        "https://github.com/go-gitea/gitea/pull/36344",
        "https://github.com/go-gitea/gitea/pull/36349"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-284",
          "CWE-639"
        ],
        "cna_assigner": "Gitea",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/20xxx/CVE-2026-20897.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-20897",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 502129,
  "published_at": "2026-01-22T22:01:51.508+00:00"
}