Gitea's issue and comment attachment update functionality improperly accepts attachment UUIDs without verifying repository ownership. This allows an authenticated attacker with edit permissions on issues or comments in a repository they can read to re-link a known victim's attachment UUID to their own issue or comment. As a result, subsequent access checks use the attacker's repository authorization context, potentially exposing private attachment content from the victim repository. The vulnerability affects all versions prior to 1.27.0. A patch is available that enforces repository and linkage validation before attachment updates.

An attacker with limited privileges (read access and ability to edit issues/comments) can gain unauthorized access to private attachment content from other repositories by re-linking attachments. This leads to confidentiality breaches of private data stored as attachments. The vulnerability does not allow modification of victim repository data but exposes sensitive content through improper access control.

A patch is available for Gitea that fixes this vulnerability by adding repository and linkage validation before updating attachments. Users should upgrade to version 1.27.0 or later to remediate this issue. Until patched, restrict issue and comment editing permissions to trusted users and avoid sharing attachment UUIDs publicly.