Draft Release Exposure in Gitea by Go-Gitea

CVE-2026-110311

What is CVE-2026-110311?

This vulnerability in Gitea arises from the API's handling of draft releases. When a user creates a draft release, the API mistakenly generates an 'assets' list without proper ID linkage. Consequently, this exposes sensitive metadata associated with attachments—such as file names, UUIDs, upload times, sizes, and download counts—from repositories the user should not have access to. Such data leakage can lead to unauthorized visibility into private repository assets, highlighting a critical need for stringent access controls and proper API validation.

References