Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 14 Oct 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker. | |
| Title | Gitea private attachment disclosure through repository mismatch | |
| Weaknesses | CWE-1220 CWE-284 CWE-639 CWE-863 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-10-14T14:38:17.247Z
Reserved: 2026-08-24T20:45:09.297Z
Link: CVE-2026-78433
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-10-14T15:17:25.637
Modified: 2026-10-14T16:04:39.483
Link: CVE-2026-78433
Redhat
No data.
OpenCVE Enrichment
No data.