CVE-2026-110494: Gitea release attachment re-linking of issue attachments
Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs write access to releases in the affected repository and must know the UUID of an attachment in that same repository. The attachment must already be linked to an issue or comment for the unintended re-linking scenario to apply.
What information or control could an attacker gain?
The attacker could expose the attachment's file name, size, and download count through a release. They could also rename or delete the attachment.
Does exploitation require access across repositories?
No. The attachment UUID must belong to an attachment in the same repository where the attacker has release write access.