Security readout for executives and security teams
Plain-English summary
A Gitea authorization flaw could expose files attached in private repositories by allowing them to be linked from a public release. For organizations using Gitea to store private build artifacts, releases, or customer code, this is a serious confidentiality risk. The provided data rates it critical, but version impact details are incomplete.
Executive priority
Treat this as urgent for any Gitea environment holding private code, release artifacts, credentials, or customer deliverables. Prioritize version confirmation and patching because the impact is private data disclosure through a public access path.
Technical view
Gitea failed to properly validate repository ownership when linking release attachments. A private-repository attachment could potentially be associated with a release in another public repository, making it available to unauthorized users. The CVSS 3.1 score is 9.1 with network access, low complexity, no privileges, and no user interaction.
Likely exposure
Exposure is most likely on Gitea instances that host both private repositories with attachments and public repositories with releases. The bundle does not provide reliable affected version ranges; it lists an anomalous version value of "0" and defaultStatus "unaffected", so confirm against the vendor advisory.
Exploitation context
The source bundle does not report active exploitation, and KEV is false. The vulnerability appears remotely reachable and low complexity based on CVSS, but no exploit status, public exploit, or observed attacks are established by the provided sources.
Researcher notes
The key control failure is repository ownership validation during attachment-to-release linking. Evidence supports CWE-283, CWE-284, and CWE-639 themes. The public bundle names patch PRs and v1.25.4 materials, but it does not clearly enumerate affected versions or exploitation in the wild.
Mitigation direction
- Review the Gitea GHSA and v1.25.4 release notes for fixed-version applicability.
- Upgrade affected Gitea deployments to the vendor-fixed release.
- Restrict public release creation and attachment workflows until patched.
- Audit private repository release attachments for sensitive content.
- Monitor Gitea logs for unusual release attachment access patterns.
Validation and detection
- Inventory all self-hosted Gitea instances and record exact versions.
- Check whether instances host private repositories with release attachments.
- Check whether public repositories and releases are enabled on the same instance.
- Confirm the applied version contains fixes from PRs #36320 and #36355.
- Review access logs for unexpected downloads of private attachment paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-283: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-20912 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-01-22T23:02:45.929Z: Reported to Red Hat.
- 2026-01-22T22:01:52.026Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security AdvisoryCVE reference, Gitea · vendor-advisory
- GitHub Pull Request #36320CVE reference, Gitea · patch
- GitHub Pull Request #36355CVE reference, Gitea · patch
- Gitea v1.25.4 ReleaseCVE reference, Gitea · release-notes
- Gitea v1.25.4 Release Blog PostCVE reference, Gitea · release-notes
- https://access.redhat.com/security/cve/CVE-2026-20912CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2432219CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20912.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unverified Ownership
Unverified Ownership represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.