CVE-2026-20912 | Gitea up to 1.25.3 Attachment Upload access control (GHSA-vfmv-f93v-37mw)

A vulnerability classified as critical was found in Gitea up to 1.25.3. This vulnerability affects unknown code of the component Attachment Upload Handler. The manipulation results in improper access controls.

This vulnerability is known as CVE-2026-20912. It is possible to launch the attack remotely. No exploit is available.

Upgrading the affected component is advised.