CVE-2026-78433

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The web attachment handler fails to perform cross-repository ownership checks for attachments created before 16 January 2026, instead validating permissions against the repository specified in the request URL. An unauthenticated attacker with knowledge of a private attachment's UUID can access the file by requesting it via a public repository's attachment path. This flaw may lead to the exposure of release assets or attachments from pull requests and issues.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.