External risk intelligence

Gitea Release Attachment Ownership Validation Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-20912

Gitea is a self-hosted Git service commonly deployed as a public-facing web application to facilitate code collaboration. Because it serves as a web-accessible portal for repository management, the attack surface related to release attachments is often reachable by users or anonymous visitors over the internet.

Gitea

before 1.25.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Gitea, a widely used self-hosted Git service. The issue lies in how the system handles repository ownership when linking attachments to releases, potentially allowing private attachments to be exposed in public repositories. This could lead to unauthorized access to sensitive information.

Private files exposed publicly.
Risk of unauthorized data access.
Confirm relevance and scope.

Attack Path

How an attacker could exploit the issue

An attacker could exploit Gitea by leveraging an issue with how repository ownership is verified when attaching files to releases. This vulnerability allows an attacker to link an attachment from a private repository to a release in a public repository, potentially exposing sensitive information to unauthorized viewers.

Unauthenticated access to Gitea.
Linking private attachments to public releases.
Unauthorized access to sensitive information.

Live Threat

Current exploitation, exposure, and threat context

An attacker could link attachments from private repositories to releases in public repositories, exposing sensitive information. This occurs when repository ownership is not properly validated during the attachment linking process.

Private repository attachments could be exposed.
Unauthorized linking of release attachments.
Sensitive data may become publicly accessible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Gitea deployments where repository ownership is not strictly validated when linking release attachments. Technical leaders should first direct teams to inventory all Gitea instances, assess their exposure and criticality, and identify the system owners. Subsequently, a risk-based remediation plan can be developed, potentially involving coordination with the Gitea vendor for updates or implementing compensating controls to mitigate unauthorized access to sensitive release information.

Identify Gitea instances and owners.
Verify attachment linkage and exposure.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Gitea?

Gitea is a lightweight, self-hosted platform used by teams to manage code repositories, track issues, and coordinate software development. It functions similarly to other popular Git collaboration services, providing a web-based interface that allows users to host their own version control infrastructure rather than relying on third-party cloud providers.

What does CVE-2026-20912 mean for my files?

This vulnerability is an Improper Authorization issue (CWE-284/CWE-639). It means Gitea fails to confirm who actually owns a file before attaching it to a release. Because the system does not properly verify ownership, a user could take a sensitive file from a private repository and link it to a release on a public repository, accidentally making that private data visible to anyone who can view the public project.

How is this vulnerability triggered?

An attacker triggers this by manipulating the attachment process during a release. It is important to note that this does not require complex system-level access; it relies on the application's failure to enforce boundaries between repository privacy levels. Simply interacting with the standard release attachment feature in affected versions is enough to bypass the intended security restrictions.

Is my instance at risk?

According to Halo Surface Signal, this is highly relevant if your Gitea instance is internet-facing. Because Gitea is often deployed as a web portal for public collaboration, the release attachment features are frequently reachable by anonymous visitors. If your instance is exposed to the internet, unauthorized parties can potentially exploit this validation gap to view sensitive attachments that should have remained private.

How do I secure my Gitea installation?

Start by identifying all Gitea instances within your environment and verifying which versions are currently running. Since this impacts releases prior to version 1.25.4, prioritize updating to a patched version provided by the vendor. While planning your update, review your current repository permissions to ensure no sensitive files have been incorrectly linked to public-facing releases.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.