CVE-2026-110494

Gitea release attachment re-linking of issue attachments

State: Published
Severity: 6.3 Medium
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Oct 14, 2026

Description

Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	CISA-ADP

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
GiteaGitea	28.1.0 and earlierAffected

References

GitHub Security Advisory GHSA-cwq7-782w-pxccvendor-advisory
Fix: go-gitea/gitea pull request #39839patch
Fix backport to release/v28: go-gitea/gitea pull request #39847patch
Gitea 28.2.0 release announcementrelease-notes
go-gitea/gitea v28.2.0 releaserelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.