Critical · published January 22, 2026
🚨 A sneaky flaw lets users delete locks from other repositories! In Gitea, someone with write access can breach repository boundaries without a fuss. 🔥 Think of it like an office where one employee can erase files from another's desk without permission — a major breach of trust! Just because they have a key to one room doesn’t mean they should access all the others. This is absolutely devastating! An attacker could manipulate or delete important locks from repositories they shouldn’t touch, leading to data loss, corruption, or disrupted workflows for teams relying on those files. The chaos could ripple through projects, impacting productivity and collaboration.
Think of it like an office where one employee can erase files from another's desk without permission — a major breach of trust! Just because they have a key to one room doesn’t mean they should access all the others. Gitea fails to properly validate repository ownership when deleting Git LFS locks, allowing users to remove locks associated with other repositories if they have write access, creating unintentional access issues.
This is absolutely devastating! An attacker could manipulate or delete important locks from repositories they shouldn’t touch, leading to data loss, corruption, or disrupted workflows for teams relying on those files. The chaos could ripple through projects, impacting productivity and collaboration. Patch Gitea immediately to version 1.17.6 or later to close this gap. Review user permissions carefully and ensure that only authorized users have the access they need to effectively manage their repositories. Regular audits can help prevent similar issues. You've got this! With these steps, you'll have your Gitea instance secured and running smoothly in no time. 🛡️