CVE-2026-20912

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The software does not correctly check ownership of repositories when managing attachments linked to releases. This can lead to a situation where an attachment from a private repository is incorrectly associated with a release in a public repository, potentially exposing the attachment to unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.