CVE-2026-57886
Received Received - Intake

Cross-Repository Attachment Exposure in GitHub

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Cross-repository issue/comment attachment re-linking can expose private attachment content

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-57886
EUVD
EUVD-2026-58147

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitea gitea to 1.26.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Gitea allows an attacker to re-link private attachment files from one repository to an attacker-controlled issue or comment in another repository. The system fails to verify if the attachment belongs to the target repository before updating its path, bypassing access controls.

Detection Guidance

Check Gitea logs for suspicious attachment re-linking events or unauthorized access patterns. Review browser history or logs for leaked attachment UUIDs. Inspect issue/comment edit actions in repositories for unexpected attachment changes.

Impact Analysis

If you are a Gitea user with private attachments, an attacker could gain access to those files by exploiting this flaw. The attacker needs to know the attachment UUID, which might be obtained from logs or browser history.

Compliance Impact

This vulnerability could lead to unauthorized access to private data, potentially violating GDPR or HIPAA requirements for data protection and access controls. Organizations using Gitea must address this to maintain compliance.

Mitigation Strategies

Upgrade Gitea to version 1.26.5 or later to apply the patch. Review and revoke access for any potentially exposed private attachments. Monitor repositories for unauthorized attachment re-linking attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57886. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart