CVE-2026-58432

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An authorization bypass exists in the web-level attachment endpoints where access control for draft releases is not enforced. While the API endpoints correctly restrict draft release access to users with write permissions, the web-side handler ServeAttachment() only checks for repository-level read permissions. This allows any user, including unauthenticated anonymous callers, to download the full contents of an attachment if they obtain its UUID.

This issue affects the following endpoints:

The vulnerability can be exploited if a UUID is leaked through side channels such as browser history, server logs, email, or public links. This may lead to the disclosure of sensitive information, including pre-release binaries, security-fix candidates, internal SBOMs, or draft release notes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the ServeAttachment() function or the affected web endpoints to authorized users only.