CVE-2026-20897: gitea: Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

Severity: Critical

CVSS Score: 9.1

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.