Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-78433Gitea private attachment disclosure through repository mismatch

Medium 5.9

In plain English

A medium-severity improper access control in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.4%top 69.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	1.26.0 – through 1.27.2

Weakness: CWE-284, CWE-639, CWE-863, CWE-1220 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory GHSA-frpv-2xgv-wxpq vendor-advisory
Gitea 1.27.3 release announcement release-notes
Fix: go-gitea/gitea pull request #39048 patch
Fix: go-gitea/gitea pull request #39077 patch
go-gitea/gitea v1.27.3 release release-notes