Executive brief
Gitea is a self-hosted Git service used by organizations to manage repositories and releases. In vulnerable versions, the system fails to properly check user permissions before allowing access to draft releases (unreleased versions) and their attached files. An attacker on the network can view draft release data that should be restricted to authorized users, potentially exposing confidential release information, roadmaps, or other sensitive artifacts.
Technical details
The vulnerability is an access control bypass (CWE-284) in Gitea's release endpoint handling. The application fails to enforce proper permission checks when users attempt to access draft releases and associated attachments via the API. An attacker with network access to a vulnerable Gitea instance can retrieve draft release data without requiring any authentication or special privileges. The vulnerability affects Gitea versions prior to 1.25.5. The fix involves adding explicit write permission validation before allowing access to draft releases, as addressed in pull requests #36659 and #36715. No user interaction is required to exploit this vulnerability.
Affected products
- Gitea Gitea < 1.25.5
Timeline
- 2026-07-03: disclosed
- 2026-03-16: patched: Patch released in Gitea 1.25.5