Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 22 Jan 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories. | |
| Title | Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) | |
| Weaknesses | CWE-284 CWE-639 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-01-22T22:01:51.508Z
Reserved: 2026-01-08T23:02:37.525Z
Link: CVE-2026-20897
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-22T22:16:18.960
Modified: 2026-01-22T22:16:18.960
Link: CVE-2026-20897
Redhat
No data.
OpenCVE Enrichment
No data.