Description
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.
Published: 2026-10-14
Score: n/a
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.
Title Gitea private attachment disclosure through repository mismatch
Weaknesses CWE-1220
CWE-284
CWE-639
CWE-863
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-10-14T14:38:17.247Z

Reserved: 2026-08-24T20:45:09.297Z

Link: CVE-2026-78433

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-14T15:17:25.637

Modified: 2026-10-14T16:04:39.483

Link: CVE-2026-78433

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses