Executive brief
Gitea, a popular self-hosted platform for managing software code, contains a flaw that allows unauthorized users to access files attached to 'draft' releases. While these releases are intended to be private until officially published, an attacker who obtains the unique identifier (UUID) for an attachment can download it without any authentication. This could lead to the exposure of sensitive pre-release software, security fixes, or internal documentation before they are ready for public release.
Technical details
A missing authorization vulnerability (CWE-862) exists in Gitea's web-side handler 'ServeAttachment' within 'routers/web/repo/attachment.go'. While Gitea previously implemented 'canAccessReleaseDraft' checks for API endpoints to ensure only users with write access can view draft releases and their assets, the web-level UUID-based endpoints were overlooked. These endpoints only verify repository-level read permissions and do not check the 'IsDraft' status of the associated release. An attacker who obtains a valid attachment UUID—which may be leaked via API responses, logs, browser history, or side channels—can bypass authentication to download the attachment. This issue represents an incomplete fix for a previous vulnerability (CVE-2026-27660). The vulnerability is addressed in Gitea version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: advisory: Initial GitHub Advisory published
- 2026-07-21: advisory: Advisory updated