Vulnerability · Published Oct 18, 2026 · Assigned by Gitea

CVE-2026-110311Gitea draft release creation disclosing attachment metadata

Medium 4.3

In plain English

A medium-severity information exposure in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 87.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	1.22.0 – through 28.1.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory GHSA-8j56-f865-gqq2 vendor-advisory
Fix: go-gitea/gitea pull request #39743 patch
Fix backport to release/v28: go-gitea/gitea pull request #39752 patch
Gitea 28.2.0 release announcement release-notes
go-gitea/gitea v28.2.0 release release-notes