CVE-2026-20897

CriticalCVSS 9.1/10Last modified Jul 15, 2026

Description

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284 CWE-639

Affected software

Vendor	Product	Versions
Gitea	Gitea Open Source Git Server	<= 1.25.3
Red Hat	OpenShift Pipelines	—
Red Hat	OpenShift Pipelines	—
Red Hat	OpenShift Pipelines	—
Red Hat	OpenShift Pipelines	—
Red Hat	OpenShift Pipelines	—
Red Hat	OpenShift Pipelines	—
Red Hat	OpenShift Pipelines	—
Red Hat	OpenShift Pipelines	—
Red Hat	OpenShift Pipelines	—

References

https://blog.gitea.com/release-of-1.25.4/Release Notes
https://github.com/go-gitea/gitea/pull/36344Issue Tracking, Patch
https://github.com/go-gitea/gitea/pull/36349Issue Tracking, Patch
https://github.com/go-gitea/gitea/releases/tag/v1.25.4Release Notes
https://github.com/go-gitea/gitea/security/advisories/GHSA-rrq5-r9h5-pc7cBroken Link
https://access.redhat.com/security/cve/CVE-2026-20897
https://bugzilla.redhat.com/show_bug.cgi?id=2432204
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20897.json

Timeline

Published: Jan 22, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-208987.2Improper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalati CVE-2026-20909.8A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /adm CVE-2026-209015.3Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm ad CVE-2026-209028.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote CVE-2026-209036.7Protection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation CVE-2026-209046.5Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility s CVE-2026-209056.6Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Applications may allow a CVE-2026-209066.7Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an CVE-2026-209085.3Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a CVE-2026-209095.3Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.CVE-2026-209108.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote co CVE-2026-209119.8A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A spe