CVE-2026-78433 Details
Description
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.
A vulnerability in Gitea's web attachment handling allows for unauthorized access to private repository attachments through public repository paths. This issue arises because the cross-repository ownership check is only applied to attachments created after January 16, 2026. For older attachments, the check is skipped, and permissions are incorrectly evaluated based on the repository mentioned in the request URL, rather than the one that owns the attachment. As a result, an unauthenticated attacker who knows a private attachment's UUID can retrieve it via a public repository's attachment path, exposing issue and pull request attachments or release assets.
Upgrade to Gitea version 1.27.3, which includes the necessary patch to enforce proper cross-repository checks for all attachments.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-1.27.3/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39048 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/39077 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.3 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-frpv-2xgv-wxpq | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1220 | Insufficient Granularity of Access Control | Gitea Limited |
| CWE-284 | Improper Access Control | Gitea Limited |
| CWE-639 | Authorization Bypass Through User-Controlled Key | Gitea Limited |
| CWE-863 | Incorrect Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | >= 1.26.0, <= 1.27.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |