Security readout for executives and security teams
Plain-English summary
CVE-2026-20750 is an authorization flaw in Gitea organization projects. A user allowed to write projects in one organization may be able to change projects in another organization. For businesses using Gitea across multiple teams or customers, this can undermine repository governance and project integrity.
Executive priority
Prioritize this for any shared Gitea service with multiple organizations or business units. The business risk is unauthorized modification of planning or project data across boundaries, not confirmed remote code execution. Patch planning should be urgent where organization projects are used.
Technical view
The source bundle describes an IDOR-style ownership validation failure in organization project operations. Project IDs may be accepted without confirming that the target project belongs to the authorized organization. The CVSS score is 9.1, but the description implies existing project write access is relevant, so exposure depends on enabled organization project workflows.
Likely exposure
Internet-facing or internal Gitea deployments using organization projects are the likely concern, especially multi-organization instances. The provided affected-version data lists only Gitea with version value "0", so the exact vulnerable version range is not established in the bundle.
Exploitation context
The bundle does not show CISA KEV listing or cite active exploitation. It describes a low-complexity authorization bypass with high confidentiality and integrity impact. Treat exploitation status as unconfirmed unless vendor or threat-intelligence sources state otherwise.
Researcher notes
The main uncertainty is affected-version precision. The source bundle names Gitea and links patch PRs and v1.25.4 release material, but does not provide a clear vulnerable range. Avoid overstating exploitability beyond the described cross-organization project authorization bypass.
Mitigation direction
- Review the Gitea advisory and v1.25.4 release notes for fixed-version guidance.
- Upgrade affected Gitea deployments according to vendor guidance.
- Restrict organization project write permissions until patched.
- Review audit logs for unexpected project changes across organizations.
- Monitor linked Gitea pull requests for implementation details and backport notes.
Validation and detection
- Inventory all Gitea instances and their exact versions.
- Check whether organization projects are enabled and actively used.
- Confirm deployed version includes the fixes referenced by PR #36318 and PR #36373.
- Review organization project permissions for broad write access.
- Look for cross-organization project modifications in audit or application logs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-20750 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-01-22T23:02:30.554Z: Reported to Red Hat.
- 2026-01-22T22:01:49.948Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security AdvisoryCVE reference, Gitea · vendor-advisory
- GitHub Pull Request #36318CVE reference, Gitea · patch
- GitHub Pull Request #36373CVE reference, Gitea · patch
- Gitea v1.25.4 ReleaseCVE reference, Gitea · release-notes
- Gitea v1.25.4 Release Blog PostCVE reference, Gitea · release-notes
- https://access.redhat.com/security/cve/CVE-2026-20750CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2432216CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20750.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.