CVE-2026-20736 is an access control vulnerability in Gitea where repository context verification is insufficient during attachment deletion. A user who uploaded an attachment to a repository can delete it after losing access to that repository by issuing a deletion request through another repository they can access. This flaw violates proper access control (CWE-284) and can lead to unauthorized modification of repository attachments.

The vulnerability allows unauthorized deletion of attachments by users who no longer have access to the original repository, resulting in integrity loss of repository data. Confidentiality and availability are not directly impacted according to the provided data. The CVSS score of 7.5 (high) reflects the significant impact on integrity with network attack vector, low attack complexity, and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Users should monitor the Red Hat advisory linked for updates and apply any official patches once released. Until then, consider restricting attachment deletion permissions and auditing deletion requests if possible.