Draft Release Exposure in Gitea by Go-Gitea
CVE-2026-110311

4.3MEDIUM

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
18 October 2026

What is CVE-2026-110311?

This vulnerability in Gitea arises from the API's handling of draft releases. When a user creates a draft release, the API mistakenly generates an 'assets' list without proper ID linkage. Consequently, this exposes sensitive metadata associated with attachments—such as file names, UUIDs, upload times, sizes, and download counts—from repositories the user should not have access to. Such data leakage can lead to unauthorized visibility into private repository assets, highlighting a critical need for stringent access controls and proper API validation.

Affected Version(s)

Gitea 1.22.0 <= 28.1.0

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/39743
patch
https://github.com/go-gitea/gitea/pull/39752
patch

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/danielroe
https://github.com/wxiaoguang
.