Vulnerability in Gitea Affects Release Attachments Functionality

CVE-2026-110494

What is CVE-2026-110494?

A vulnerability exists in the Gitea platform where adding attachments to a release does not validate whether these attachments are already associated with an issue or comment. This oversight allows users with write access to a repository to link existing attachments to releases by knowing the UUID of those attachments. Consequently, it exposes critical metadata such as filename, size, and download count through the release interface. Additionally, users gaining access can potentially rename or delete these attachments, leading to security complications and unauthorized data manipulations.

References