CVE-2026-110311

Received Received - Intake

Draft Release API Exposes Unauthorized Attachment Metadata

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-110311

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	1.22.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability allows a user with permission to create a draft release in a repository to access metadata of attachments they should not be able to see. The metadata includes file names, UUIDs, upload times, sizes, and download counts of issue and comment attachments from repositories they cannot read, as well as abandoned uploads.

Impact Analysis

If you have permission to create draft releases in a repository, an attacker could exploit this to gather sensitive metadata about attachments in other repositories you cannot access. This could expose information about files, uploads, or discussions that were intended to remain private.

Compliance Impact

This vulnerability could potentially expose sensitive metadata of attachments, such as file names and download counts, which may include personal or confidential data. This could lead to non-compliance with GDPR if personal data is exposed without authorization, or with HIPAA if protected health information is involved.

Mitigation Strategies

Update Gitea to the latest patched version to address the draft release API issue. Review repository permissions to ensure only authorized users can create draft releases. Monitor for unauthorized access to attachment metadata.

Hi! I’m here to help you understand CVE-2026-110311. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70