7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-20736

CVE-2026-20736: Gitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-20736

CVE-2026-20736:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	< 1.25.4	1.25.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in an improper access control flaw within Gitea's attachment deletion functionality. A user who previously uploaded an attachment to a repository could delete it even after losing access to that repository. This was achieved by making a deletion request through a different repository where the user still held permissions, while referencing the unique identifier (UUID) of the target attachment.

The root cause was the system's failure to validate that the attachment being deleted was part of the repository context of the incoming request. The code only verified if the user making the request was the original uploader of the attachment, completely ignoring the repository scope.

The analysis of the fixing commit, fbea2c68e8df11cfa94e8ead913b79946780ed30, confirms this diagnosis. Two key functions were patched:

DeleteAttachment in routers/web/repo/attachment.go: The patch introduced a critical check, if attach.RepoID != ctx.Repo.Repository.ID, which ensures the attachment's repository ID matches the ID of the repository in the current request context. This directly addresses the vulnerability for issue attachments.
DeleteReleaseAttachment in routers/api/v1/repo/release_attachment.go: In this function, a FIXME comment was removed which read: Should prove the existence of the given repo. The removal of this comment as part of the security fix indicates that this API endpoint for release attachments suffered from the same logical flaw and was patched accordingly.

Exploitation of this vulnerability would involve calls to either DeleteAttachment or DeleteReleaseAttachment, as these were the functions that processed the deletion request without proper authorization checks.

Vulnerable functions

DeleteAttachment

routers/web/repo/attachment.go

This function was vulnerable because it failed to verify that the attachment being deleted belonged to the repository specified in the request context. It only checked if the user was the original uploader. This allowed a user who had lost access to a repository to delete an attachment they had previously uploaded by making a delete request through a different repository where they still had permissions. The patch adds a check to ensure the attachment's repository ID matches the repository from the context.

DeleteReleaseAttachment

routers/api/v1/repo/release_attachment.go

This function, which handles the deletion of release attachments via the API, was vulnerable because it did not verify that the attachment belonged to the repository context of the API request. The removal of a FIXME comment that explicitly pointed out this missing check confirms the flaw. This allowed an attacker to delete a release attachment from a repository they no longer had access to.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.