CVE-2026-57886

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Issue and comment attachment update paths allow the use of attachment UUIDs without verifying if the attachment belongs to the target repository. An authenticated attacker can re-link a victim's attachment UUID to an issue or comment within a repository they control. This causes subsequent access checks to use the attacker's repository authorization context instead of the original one, potentially disclosing private attachments. This occurs because the functions UpdateIssueAttachments() and UpdateCommentAttachments() load attachments by UUID and update the linkage without validating that the attachment's RepoID matches the target repository's ID. The vulnerability affects the /attachments/{uuid} route and the files[] parameter in issue and comment edit flows.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict the ability to edit issues and comments to trusted users or implement strict monitoring of the files[] parameter in issue and comment edit flows.