Cross-Repository Ownership Check Bypass in Gitea's Attachment Handling
CVE-2026-78433

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-78433?

Gitea's web attachment handler has a vulnerability that allows an unauthenticated attacker to bypass cross-repository ownership checks for attachments created prior to January 16, 2026. This flaw occurs because the system incorrectly checks permissions based only on the repository specified in the request URL. An attacker with knowledge of a private attachment's UUID can exploit this by retrieving attachments through a public repository's path, potentially exposing sensitive issue and pull request attachments or release assets.

Affected Version(s)

Gitea 1.26.0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39048
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/iabdullah215
https://github.com/bircni
https://github.com/silverwind
.