Sploitus

CVE-2026-20912

No indexed exploits for CVE-2026-20912 yet

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

Affected products
Gitea, Red Os
Gitea
< 1.25.4
CVSS 3.1
9.1 CRITICAL
EPSS
0.4% (34th percentile)
Weakness
CWE-639, CWE-283, CWE-284
NVD status
Modified
Published
2026-01-22
CVE-2026-20912 at NVD
Authoritative description, scoring and affected products

No indexed exploits for CVE-2026-20912 yet

Our index is partial: it proves presence, never absence

No exploit for CVE-2026-20912 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.