PT-2026-63299

CVE-2026-58432

Published

2026-07-13

Updated

2026-10-12

Description by

CVSS 3.1

5.9

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An authorization bypass exists in the web-level attachment endpoints where access control for draft releases is not enforced. While the API endpoints correctly restrict draft release access to users with write permissions, the web-side handler ServeAttachment() only checks for repository-level read permissions. This allows any user, including unauthenticated anonymous callers, to download the full contents of an attachment if they obtain its UUID.

This issue affects the following endpoints:

/attachments/{uuid}
/{owner}/{repo}/attachments/{uuid}
/{owner}/{repo}/releases/attachments/{uuid}

The vulnerability can be exploited if a UUID is leaked through side channels such as browser history, server logs, email, or public links. This may lead to the disclosure of sensitive information, including pre-release binaries, security-fix candidates, internal SBOMs, or draft release notes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the ServeAttachment() function or the affected web endpoints to authorized users only.

Exploitability

Exploit

Impacts