CVE-2026-20736: Ghost in the Repo: Deleting Gitea Attachments from the Grave - CVE Security Report

CVE-2026-20736.md

CVE-2026-20736: Ghost in the Repo: Deleting Gitea Attachments from the Grave

CVSS Score: 7.5 Published: 2026-01-23 Full Report: https://cvereports.com/reports/CVE-2026-20736

Summary

A logic flaw in Gitea's attachment handling allowed users to delete files from repositories they no longer had access to. If you uploaded it, you could kill it—even after being fired.

TL;DR

An Improper Access Control vulnerability in Gitea <= 1.25.3 allows a user to delete attachments they previously uploaded to a repository, even after their access to that repository has been revoked. By piggybacking on a request to a different repository they do control, attackers can purge critical evidence or release artifacts.

Exploit Status: POC

Technical Details

• CWE ID: CWE-284
• Attack Vector: Network
• CVSS v3.1: 7.5 (High)
• Affected Versions: <= 1.25.3
• Patch Version: 1.25.4
• Impact: Data Integrity Loss

Affected Systems

• Gitea self-hosted instances
• Gitea: <= 1.25.3 (Fixed in: 1.25.4)

Mitigation

• Upgrade Gitea to version 1.25.4 or later immediately.
• Restrict public registration to prevent attackers from creating new 'pivot' repositories.
• Regularly audit attachment deletion logs for suspicious activity.

Remediation Steps:

1. Backup your current Gitea database and configuration.
2. Download the 1.25.4 binary or pull the latest docker image: docker pull gitea/gitea:1.25.4.
3. Restart the Gitea service.
4. Verify the version in the footer of the Gitea web interface.

References

• GHSA Advisory
• Gitea 1.25.4 Release Notes

---

Generated by CVEReports - Automated Vulnerability Intelligence