Gitea does not properly validate project ownership in organization project operations
Date: 2026-01
Affected: go/github.com/go-gitea/gitea
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-20750
CWE: CWE-284

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.


Mitigations:

Architectural layers (MAESTRO):