CVE-2026-58432
Received Received - Intake

Authorization Bypass in Gitea Exposes Sensitive Data

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-58432
EUVD
EUVD-2026-58159

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gitea gitea *
go-gitea gitea to 1.26.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves missing authorization checks in Gitea versions up to 1.26.4. While API endpoints enforce write permissions for draft release attachments, web-level endpoints do not. This allows unauthenticated users or non-collaborators to download draft attachments if they have the attachment UUID, which may be exposed in URLs or logs. The issue stems from the ServeAttachment handler not verifying draft release permissions.

Detection Guidance

To detect this vulnerability, check Gitea logs for unauthorized access attempts to draft release attachments. Look for requests to endpoints serving attachments with draft release UUIDs. Verify if the browser_download_url field exposes sensitive draft content. Inspect web router handlers for missing permission checks in ServeAttachment.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive draft release attachments, such as pre-release binaries or security-fix artifacts. If an attacker obtains the attachment UUID through browser history, logs, or shared URLs, they may download confidential content without proper authorization.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, potentially violating compliance requirements like GDPR (data protection) or HIPAA (health information privacy). Unauthorized access to draft attachments may result in data breaches, triggering regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade Gitea to version 1.26.4 or later to apply the fix for authorization checks in web handlers. Ensure ServeAttachment enforces write permissions for draft releases. Review and restrict access to browser_download_url fields to prevent UUID exposure. Monitor logs for suspicious access patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart