CVE-2026-20912
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository c
CVSS
9.1
Crítico
EPSS
0.4%
p35
KEV
—
Exploit Today
11
0-100
Publicado: 22 ene 2026 · Última mod.: 15 jul 2026 · CWE-284 · CWE-639 · CWE-283
0.4%EPSS · 30 días0.4%
2026-08-072026-09-04
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
- blog.gitea.comhttps://blog.gitea.com/release-of-1.25.4/
- github.comhttps://github.com/go-gitea/gitea/pull/36320
- github.comhttps://github.com/go-gitea/gitea/pull/36355
- github.comhttps://github.com/go-gitea/gitea/releases/tag/v1.25.4
- github.comhttps://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-20912
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2432219
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20912.json
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-861764.3 MED—
——0NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.3hCVE-2026-861744.3 MED—
——0Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.3hCVE-2026-861136.5 MED—
——0BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.4hCVE-2026-861125.4 MED—
——0BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create unauthorized interactions, trigger ActivityPub broadcasts, and enumerate private status IDs through response differentiation.4hCVE-2026-861116.5 MED—
——0BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit view, bypassing the privacy protections documented for these message types.4hCVE-2026-857818.7 ALT—
——0Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem.
To remediate this issue, users should upgrade to version v3.4.1.18h