Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 23 Jan 2026 08:00:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization. | |
| Title | Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR) | |
| Weaknesses | CWE-284 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-01-22T22:01:49.948Z
Reserved: 2026-01-08T23:02:37.565Z
Link: CVE-2026-20750
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-22T22:16:17.370
Modified: 2026-01-22T22:16:17.370
Link: CVE-2026-20750
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses