9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-20750

CVE-2026-20750: Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-20750

CVE-2026-20750:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/go-gitea/gitea	go	< 1.25.4	1.25.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an improper access control issue in Gitea's organization project management. Multiple functions responsible for handling project operations (like creation, deletion, and modification of projects and their columns) in routers/web/org/projects.go did not properly validate that the project being acted upon belonged to the organization of the user making the request. The functions would fetch project data using just the project ID from the user's request. An attacker with write access to a project in their own organization could exploit this by sending a request with the ID of a project from a different organization, allowing them to perform unauthorized actions.

The patch addresses this by introducing new data access functions, GetProjectByIDAndOwner and GetColumnByIDAndProjectID, which include ownership checks directly within the database query. The vulnerable functions were then updated to use these new, more secure functions, ensuring that all project operations are properly authorized and scoped to the user's organization.

Vulnerable functions

org.ChangeProjectStatus

routers/web/org/projects.go

The function previously changed a project's status without verifying that the project belonged to the user's organization. It directly used the project ID from the request. The patch fixes this by first fetching the project using `GetProjectByIDAndOwner`, which ensures the project belongs to the currently authenticated user's organization before changing its status.

org.DeleteProject

routers/web/org/projects.go

The function used `GetProjectByID` to fetch the project and then performed a separate check for ownership. This pattern is less secure than an atomic database query. The vulnerability allowed a user to delete a project from another organization. The patch replaces the call with `GetProjectByIDAndOwner`, which includes the ownership check in the database query.

org.RenderEditProject

routers/web/org/projects.go

This function, which renders the project editing page, fetched the project by ID without ensuring it belonged to the user's organization. This could allow an attacker to view the edit page details of a project in another organization. The fix enforces ownership by using `GetProjectByIDAndOwner`.

org.EditProjectPost

routers/web/org/projects.go

This function, which handles the submission of project edits, did not properly validate project ownership. An attacker could modify a project in a different organization by crafting a POST request with the target project's ID. The patch corrects this by using `GetProjectByIDAndOwner`.

org.ViewProject

routers/web/org/projects.go

The function to view a project's board was vulnerable as it fetched the project by ID without validating ownership, potentially allowing a user to view projects from other organizations. The patch enforces this check using `GetProjectByIDAndOwner`.

org.DeleteProjectColumn

routers/web/org/projects.go

This function allowed deleting a column from a project. It failed to validate that the project belonged to the user's organization and that the column belonged to that project, allowing an attacker to delete columns from projects in other organizations. The patch adds checks for both project and column ownership.

org.AddColumnToProjectPost

routers/web/org/projects.go

This function, for adding a column to a project, did not validate project ownership. This could allow a user to add a column to a project in another organization. The patch fixes this by using `GetProjectByIDAndOwner`.

org.CheckProjectColumnChangePermissions

routers/web/org/projects.go

This helper function for checking permissions did not properly validate ownership of the project or the column. The patch fixes this by using the new secure data access functions `GetProjectByIDAndOwner` and `GetColumnByIDAndProjectID`.

org.MoveIssues

routers/web/org/projects.go

This function for moving issues between project columns was vulnerable because it did not validate project and column ownership correctly. An attacker could potentially move issues in a project belonging to another organization. The patch enforces these checks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.