[ CVE-2026-110311 · Published 18 Oct 2026 ]
Vulnerability in Gitea
CVSS 4.3
EPSS <1%1 agency advisoryNo fix listed yet
[ Description ]Official description
Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
BSI CERT-BundWID-SEC-2026-4021
Gitea: Multiple vulnerabilities Translated from German