Threats Tagged 'ghsa-6c6r-5xr4-cr5m'

Gitea contains a vulnerability in its issue and comment attachment update functionality where attachment UUIDs are accepted without verifying repository ownership. An authenticated attacker who can edit issues or comments in a repository they can read can re-link a known victim attachment UUID to their own issue or comment. This causes subsequent access checks to use the attacker's repository authorization context, potentially exposing private attachment content. The issue affects versions prior to 1.27.0 and remains unpatched at the time of reporting. The vulnerability does not require write access to the victim repository but does require knowledge of the attachment UUID. A fix involves adding repository and linkage validation before updating attachments.