Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions… (CVE-2026-78433)

The vulnerability in Gitea's web attachment handler involves bypassing cross-repository ownership verification for attachments created before 16 January 2026. Instead of verifying permissions against the actual repository owning the attachment, the handler checks permissions against the repository named in the request URL. This flaw enables unauthenticated attackers who know a private attachment's UUID to retrieve its contents through a public repository's attachment URL path. The exposure includes attachments related to issues, pull requests, and release assets. The attack requires prior knowledge of the attachment's UUID, which is a random identifier.

An unauthenticated attacker can access private attachments if they know the UUID, leading to unauthorized disclosure of potentially sensitive information contained in issue attachments, pull request attachments, or release assets. There is no impact on integrity or availability. The vulnerability has a CVSS 3.1 base score of 5.9 (medium severity), reflecting the network attack vector, high attack complexity, no privileges required, no user interaction, and confidentiality impact only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to attachment UUIDs and minimizing exposure of UUIDs may reduce risk.