Vulnerability · Published Oct 18, 2026 · Assigned by Gitea

CVE-2026-110494Gitea release attachment re-linking of issue attachments

Medium 6.3

In plain English

A medium-severity authorization bypass via user-controlled key in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 90.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 28.1.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

GitHub Security Advisory GHSA-cwq7-782w-pxcc vendor-advisory
Fix: go-gitea/gitea pull request #39839 patch
Fix backport to release/v28: go-gitea/gitea pull request #39847 patch
Gitea 28.2.0 release announcement release-notes
go-gitea/gitea v28.2.0 release release-notes