Gitea's improper validation of repository ownership when associating attachments with releases can lead to unauthorized access. Specifically, an attachment from a private repository can be linked to a release in a separate public repository, bypassing intended access restrictions. This vulnerability is classified under CWE-284 (Improper Access Control) and related CWEs, indicating a failure to enforce proper authorization checks. The CVSS v3.1 base score is 9.1 (critical), reflecting the high impact on confidentiality and integrity without requiring privileges or user interaction.

An attacker can gain unauthorized access to attachments originally uploaded to private repositories by linking them to releases in public repositories. This leads to a confidentiality breach, exposing potentially sensitive data to unauthorized users. The integrity of repository data can also be impacted due to improper access control. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-20912 for updates on patches or official mitigations. Until a fix is available, restrict repository release attachment operations to trusted users and review repository permissions carefully to minimize exposure risk.