CVE-2026-20736 — Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing a…
Published: 2026-01-22 · CVSS: 7.5 · CVSS 3.1
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7