External risk intelligence

Gitea Project Ownership Validation Flaw Allows Cross-Organization Modification.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-20750

Gitea is commonly deployed as a self-hosted, internet-facing web application for code hosting and collaboration. Because these instances are frequently exposed to the public internet to facilitate remote access for developers and automated systems, the vulnerable project management functionality is often reachable from the internet.

Gitea

before 1.25.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Gitea could allow unauthorized users to modify projects across different organizations. This issue impacts how project ownership is managed within the Gitea platform, potentially leading to unintended changes to sensitive project data. The main concern is confirming relevance and exposure.

Unauthorized project changes possible.
Review Gitea project access controls.
Confirm Gitea's scope in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging write access to projects within one organization to gain unauthorized control over projects in another organization. This could lead to sensitive information disclosure or unauthorized modifications.

Publicly accessible Gitea instances.
Unauthorized project modification.
Compromise of sensitive project data.

Live Threat

Current exploitation, exposure, and threat context

When Gitea does not properly validate project ownership, a user with write access to projects in one organization could potentially modify projects in a different organization. This could affect project data and service behavior under certain conditions when the application is accessible.

Project data and settings.
Unauthorized modification of projects.
Compromised project integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Gitea instances, potentially impacting teams responsible for application hosting and security. The first practical step is to identify all Gitea deployments, determine their accessibility and criticality, and pinpoint the accountable owner for each instance. Subsequent remediation planning should align with the identified risks and operational constraints.

Gitea administrators own the issue.
Verify project ownership validation.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Gitea?

Gitea is a lightweight, open-source platform used for hosting software development projects. It provides tools for version control, issue tracking, and project management, acting as a collaborative hub where teams store code and manage their software development lifecycles.

What is the vulnerability in CVE-2026-20750?

This CVE involves a failure in access control, classified as CWE-284 (Improper Access Control). Specifically, Gitea fails to properly verify if a user has the correct permissions to modify a project. This allows an authenticated user to bypass ownership checks and potentially change project settings or data that belong to an entirely different organization.

Does this flaw trigger if I do not have project write access?

No. The vulnerability specifically requires the attacker to already possess project write access within at least one organization in the Gitea instance. If a user has no write access to any projects, they cannot leverage this flaw to modify projects in other organizations.

Is my Gitea instance at risk?

Halo Surface Signal indicates that Gitea is commonly deployed as a self-hosted, internet-facing application, making it highly reachable by external threats. If your instance is exposed to the public internet to support remote development, it is more likely to be targeted compared to an instance restricted to an internal, private network.

How do I address this CVE?

First, identify all Gitea deployments within your infrastructure and confirm their network accessibility. Review which instances are running version 1.25.4 or later, as the vulnerability affects all previous versions. Your immediate priority is to plan an update to a secure version to ensure proper project ownership validation is restored.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.