id: GO-ID-PENDING
modules:
- module: code.gitea.io/gitea
versions:
- fixed: 1.25.4
vulnerable_at: 1.25.3
summary: |-
Gitea does not properly validate repository ownership when deleting Git LFS
locks in code.gitea.io/gitea
cves:
- CVE-2026-20897
ghsas:
- GHSA-393c-qgvj-3xph
references:
- advisory: https://github.com/advisories/GHSA-393c-qgvj-3xph
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-20897
- fix: https://github.com/go-gitea/gitea/commit/da036f3f35ca830b22cf4480912ed261303b798f
- fix: https://github.com/go-gitea/gitea/pull/36344
- fix: https://github.com/go-gitea/gitea/pull/36349
- web: https://blog.gitea.com/release-of-1.25.4
- web: https://github.com/go-gitea/gitea/releases/tag/v1.25.4
source:
id: GHSA-393c-qgvj-3xph
created: 2026-01-23T21:01:25.871219578Z
review_status: UNREVIEWED
Advisory GHSA-393c-qgvj-3xph references a vulnerability in the following Go modules:
Description:
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.