Gitea's draft-release access control is enforced on API endpoints but missing on web attachment endpoints. The web handler ServeAttachment checks only repository read permissions and does not verify the IsDraft flag on linked releases. This allows unauthenticated users who obtain the UUID of an attachment belonging to a draft release to download it. The API was fixed in February 2026 to require write access for draft release visibility, but the web handler was not updated accordingly. The vulnerability affects all Gitea versions before 1.27.0. The root cause is that the web attachment handler does not perform the canAccessReleaseDraft check, allowing unauthorized disclosure of draft release attachments.

Unauthorized users, including unauthenticated callers, can access and download attachments belonging to draft releases if they know or obtain the UUID of the attachment. This leads to information disclosure of potentially sensitive draft release content that should be restricted to users with write access. The draft releases themselves remain hidden from listings and direct API queries, but the attachment URLs bypass these protections. This represents a confidentiality breach but does not affect integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested patch involves updating the web attachment handler to enforce write access checks for draft release attachments, similar to the API fix implemented in February 2026. Until a patch is applied, avoid sharing or exposing draft release attachment URLs containing UUIDs. Monitor official Gitea releases and advisories for an official fix and apply updates promptly once available.