Zulloper

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** Issue and comment attachment update paths allow the use of attachment UUIDs without verifying if the attachment belongs to the target repository. An authenticated attacker can re-link a victim's attachment UUID to an issue or comment within a repository they control. This causes subsequent access checks to use the attacker's repository authorization context instead of the original one, potentially disclosing private attachments. This occurs because the functions `UpdateIssueAttachments()` and `UpdateCommentAttachments()` load attachments by UUID and update the linkage without validating that the attachment's `RepoID` matches the target repository's ID. The vulnerability affects the `/attachments/{uuid}` route and the `files[]` parameter in issue and comment edit flows. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict the ability to edit issues and comments to trusted users or implement strict monitoring of the `files[]` parameter in issue and comment edit flows.