Skip to content

Commit 591b74b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-393c-qgvj-3xph GHSA-4xx9-vc8v-87hv GHSA-9cgq-wp42-4rpq GHSA-qqgv-v353-cv8p GHSA-rw22-5hhq-pfpf
1 parent 1dad469 commit 591b74b

5 files changed

Lines changed: 196 additions & 50 deletions

File tree

advisories/unreviewed/2026/01/GHSA-393c-qgvj-3xph/GHSA-393c-qgvj-3xph.json renamed to advisories/github-reviewed/2026/01/GHSA-393c-qgvj-3xph/GHSA-393c-qgvj-3xph.json

Lines changed: 40 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,41 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-393c-qgvj-3xph",
4-
"modified": "2026-01-23T00:31:17Z",
4+
"modified": "2026-01-23T20:14:46Z",
55
"published": "2026-01-23T00:31:16Z",
66
"aliases": [
77
"CVE-2026-20897"
88
],
9+
"summary": "Gitea does not properly validate repository ownership when deleting Git LFS locks",
910
"details": "Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.",
10-
"severity": [],
11-
"affected": [],
12-
"references": [
11+
"severity": [
1312
{
14-
"type": "WEB",
15-
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rrq5-r9h5-pc7c"
16-
},
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/go-gitea/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.25.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
1739
{
1840
"type": "ADVISORY",
1941
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20897"
@@ -26,10 +48,18 @@
2648
"type": "WEB",
2749
"url": "https://github.com/go-gitea/gitea/pull/36349"
2850
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/go-gitea/gitea/commit/da036f3f35ca830b22cf4480912ed261303b798f"
54+
},
2955
{
3056
"type": "WEB",
3157
"url": "https://blog.gitea.com/release-of-1.25.4"
3258
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/go-gitea/gitea"
62+
},
3363
{
3464
"type": "WEB",
3565
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
@@ -39,9 +69,9 @@
3969
"cwe_ids": [
4070
"CWE-284"
4171
],
42-
"severity": null,
43-
"github_reviewed": false,
44-
"github_reviewed_at": null,
72+
"severity": "MODERATE",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-01-23T20:14:46Z",
4575
"nvd_published_at": "2026-01-22T22:16:18Z"
4676
}
4777
}

advisories/unreviewed/2026/01/GHSA-4xx9-vc8v-87hv/GHSA-4xx9-vc8v-87hv.json renamed to advisories/github-reviewed/2026/01/GHSA-4xx9-vc8v-87hv/GHSA-4xx9-vc8v-87hv.json

Lines changed: 40 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,41 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4xx9-vc8v-87hv",
4-
"modified": "2026-01-23T00:31:17Z",
4+
"modified": "2026-01-23T20:14:52Z",
55
"published": "2026-01-23T00:31:17Z",
66
"aliases": [
77
"CVE-2026-20912"
88
],
9+
"summary": "Gitea does not properly validate repository ownership when linking attachments to releases",
910
"details": "Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.",
10-
"severity": [],
11-
"affected": [],
12-
"references": [
11+
"severity": [
1312
{
14-
"type": "WEB",
15-
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-vfmv-f93v-37mw"
16-
},
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/go-gitea/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.25.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
1739
{
1840
"type": "ADVISORY",
1941
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20912"
@@ -26,10 +48,18 @@
2648
"type": "WEB",
2749
"url": "https://github.com/go-gitea/gitea/pull/36355"
2850
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/go-gitea/gitea/commit/fbea2c68e8df11cfa94e8ead913b79946780ed30"
54+
},
2955
{
3056
"type": "WEB",
3157
"url": "https://blog.gitea.com/release-of-1.25.4"
3258
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/go-gitea/gitea"
62+
},
3363
{
3464
"type": "WEB",
3565
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
@@ -39,9 +69,9 @@
3969
"cwe_ids": [
4070
"CWE-284"
4171
],
42-
"severity": null,
43-
"github_reviewed": false,
44-
"github_reviewed_at": null,
72+
"severity": "MODERATE",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-01-23T20:14:52Z",
4575
"nvd_published_at": "2026-01-22T22:16:19Z"
4676
}
4777
}

advisories/unreviewed/2026/01/GHSA-9cgq-wp42-4rpq/GHSA-9cgq-wp42-4rpq.json renamed to advisories/github-reviewed/2026/01/GHSA-9cgq-wp42-4rpq/GHSA-9cgq-wp42-4rpq.json

Lines changed: 36 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,41 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9cgq-wp42-4rpq",
4-
"modified": "2026-01-23T00:31:16Z",
4+
"modified": "2026-01-23T20:14:41Z",
55
"published": "2026-01-23T00:31:16Z",
66
"aliases": [
77
"CVE-2026-20888"
88
],
9+
"summary": "Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface",
910
"details": "Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.",
10-
"severity": [],
11-
"affected": [],
12-
"references": [
11+
"severity": [
1312
{
14-
"type": "WEB",
15-
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-ccq9-c5hv-cf64"
16-
},
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/go-gitea/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.25.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
1739
{
1840
"type": "ADVISORY",
1941
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20888"
@@ -30,6 +52,10 @@
3052
"type": "WEB",
3153
"url": "https://blog.gitea.com/release-of-1.25.4"
3254
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/go-gitea/gitea"
58+
},
3359
{
3460
"type": "WEB",
3561
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
@@ -39,9 +65,9 @@
3965
"cwe_ids": [
4066
"CWE-284"
4167
],
42-
"severity": null,
43-
"github_reviewed": false,
44-
"github_reviewed_at": null,
68+
"severity": "MODERATE",
69+
"github_reviewed": true,
70+
"github_reviewed_at": "2026-01-23T20:14:41Z",
4571
"nvd_published_at": "2026-01-22T22:16:17Z"
4672
}
4773
}

advisories/unreviewed/2026/01/GHSA-qqgv-v353-cv8p/GHSA-qqgv-v353-cv8p.json renamed to advisories/github-reviewed/2026/01/GHSA-qqgv-v353-cv8p/GHSA-qqgv-v353-cv8p.json

Lines changed: 40 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,41 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qqgv-v353-cv8p",
4-
"modified": "2026-01-23T00:31:17Z",
4+
"modified": "2026-01-23T20:15:01Z",
55
"published": "2026-01-23T00:31:17Z",
66
"aliases": [
77
"CVE-2026-20904"
88
],
9+
"summary": "Gitea does not properly validate ownership when toggling OpenID URI visibility",
910
"details": "Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.",
10-
"severity": [],
11-
"affected": [],
12-
"references": [
11+
"severity": [
1312
{
14-
"type": "WEB",
15-
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jrpc-w85r-hgqx"
16-
},
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/go-gitea/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.25.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
1739
{
1840
"type": "ADVISORY",
1941
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20904"
@@ -26,10 +48,18 @@
2648
"type": "WEB",
2749
"url": "https://github.com/go-gitea/gitea/pull/36361"
2850
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/go-gitea/gitea/commit/ed5720af2ac94d74f822721c05b42b6148ff9c22"
54+
},
2955
{
3056
"type": "WEB",
3157
"url": "https://blog.gitea.com/release-of-1.25.4"
3258
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/go-gitea/gitea"
62+
},
3363
{
3464
"type": "WEB",
3565
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
@@ -39,9 +69,9 @@
3969
"cwe_ids": [
4070
"CWE-284"
4171
],
42-
"severity": null,
43-
"github_reviewed": false,
44-
"github_reviewed_at": null,
72+
"severity": "MODERATE",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-01-23T20:15:01Z",
4575
"nvd_published_at": "2026-01-22T22:16:19Z"
4676
}
4777
}

0 commit comments

Comments
 (0)