Executive brief
Gitea is an open-source forge software package for hosting software development version control using Git. A vulnerability in how Gitea handles file attachments in issues and comments allows an authenticated user to re-link private attachments to their own public repositories if they know the attachment's unique identifier (UUID). This could lead to the unauthorized disclosure of private documents, images, or other files attached to restricted issues or comments.
Technical details
The vulnerability exists in the `UpdateIssueAttachments` and `UpdateCommentAttachments` functions within Gitea's web issue/comment handling logic. These functions load attachments by UUID and update their linkage without validating that the attachment's `RepoID` matches the target repository's ID. An authenticated attacker who knows a victim's attachment UUID can submit it through an issue or comment edit flow in a repository they control. Because Gitea resolves attachment access permissions based on the linked repository, this re-linking causes the system to serve the private file under the attacker's authorization context. This issue is fixed in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed: Initial disclosure to Gitea
- 2026-07-21: advisory: GitHub Advisory published
- 2026-07-21: patched: Fixed in version 1.27.0