CVE-2026-78433: Gitea private attachment disclosure through repository mismatch
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.
Affected Software
Event History
Frequently Asked Questions
Which attachments are exposed?
The issue affects private issue and pull request attachments and release assets that were created before 16 January 2026. The attacker must request the attachment through the attachment path of a public repository.
What does an attacker need to exploit this?
No authentication is required, but the attacker must know the private attachment's UUID. The UUID is random, so the described attack depends on the UUID having already been disclosed or otherwise obtained.
Are newly created attachments affected?
The described ownership-check bypass applies to attachments created before 16 January 2026. The provided information does not indicate that attachments created on or after that date are affected.