CVE-2026-20912
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository c
CVSS
9.1
Critical
EPSS
0.4%
p35
KEV
—
Exploit Today
11
0-100
Published: Jan 22, 2026 · Last modified: Jul 15, 2026 · CWE-284 · CWE-639 · CWE-283
0.4%EPSS · 30 days0.4%
2026-08-072026-09-03
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
- blog.gitea.comhttps://blog.gitea.com/release-of-1.25.4/
- github.comhttps://github.com/go-gitea/gitea/pull/36320
- github.comhttps://github.com/go-gitea/gitea/pull/36355
- github.comhttps://github.com/go-gitea/gitea/releases/tag/v1.25.4
- github.comhttps://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-20912
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2432219
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20912.json
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-857818.7 HIG—
———Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem.
To remediate this issue, users should upgrade to version v3.4.1.17hCVE-2026-856387.3 HIG—
———A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.18hCVE-2026-616886.5 MED—
———SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGrid` component. Version 3.0.1 fixes the issue.19hCVE-2026-176274.9 MED—
———IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.19hCVE-2026-751686.3 MED—
———An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/.20hCVE-2026-192749.6 CRI—
———IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlled namespace to silently overwrite the shared `ClusterRoleBinding` or delete it outright and revoke the victim agent's cluster monitoring access.19h