CVE-2026-20897 is an improper access control vulnerability (CWE-284) in Gitea Open Source Git Server. The issue arises because Gitea does not correctly verify repository ownership when processing requests to delete Git Large File Storage (LFS) locks. Consequently, a user who has write permissions on one repository can delete LFS locks from other repositories, potentially disrupting repository operations or causing data integrity issues. The vulnerability has a high impact on confidentiality and integrity but does not affect availability. No known exploits are reported in the wild. The Red Hat advisory linked does not provide explicit patch or remediation details.

An attacker with write access to a repository can delete Git LFS locks from other repositories, which may lead to unauthorized modification or disruption of repository data integrity. This compromises the confidentiality and integrity of repository lock management but does not impact availability. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided Red Hat advisory link does not specify an official fix or workaround. Until a patch or official mitigation is available, restrict write access to trusted users only and monitor repository activities closely to detect any unauthorized LFS lock deletions.