Authorization bypass through user-controlled key in Gitea - CVE-2026-110494
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote user to disclose issue attachment metadata and rename or permanently delete issue attachments without the corresponding issue access.
The vulnerability exists due to a missing authorization check on IssueID in Gitea's AddReleaseAttachments function in models/repo/release.go when linking attachments to releases. A remote user can use release write permission and a known attachment UUID to link an issue attachment from the same repository to a release they control, exposing its filename, UUID, size, and download count and enabling its renaming or permanent deletion.
File content downloads remain subject to issue-level read permission because the download handler checks IssueID before ReleaseID.