CVE-2026-20897 — Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other …
Published: 2026-01-22 · CVSS: 9.1 · CVSS 3.1
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7