CVE-2026-78433 in Gitea
Summary
by MITRE • 10/15/2026
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Gitea represents a critical authentication bypass within the web attachment handling subsystem, specifically affecting files created prior to January 16, 2026. This flaw stems from an inconsistency in how the application validates access control policies for attachments stored across different repositories. In a properly secured multi-tenant or private repository environment, Gitea is designed to enforce strict ownership checks that ensure only authorized users can retrieve specific assets such as issue comments, pull request artifacts, and release binaries. However, due to this implementation defect, the system fails to perform the necessary cross-repository ownership verification for legacy attachments. Instead of validating whether the requesting user has permission relative to the actual owner of the attachment, the handler erroneously checks permissions against the repository identified in the incoming URL path. This logical error creates a significant security gap that allows unauthorized access under specific conditions.
From an operational perspective, this vulnerability enables unauthenticated attackers to retrieve sensitive data if they possess knowledge of the target attachment's universally unique identifier (UUID). The attacker does not need valid credentials or prior authentication with the Gitea instance; instead, they only require the UUID of a private attachment and must know which public repository path can be used as an entry point. By constructing a request that points to a public repository but references the UUID of a private asset, the flawed logic causes the server to bypass the intended isolation boundaries. Consequently, confidential issue discussions, proprietary pull request attachments, or internal release assets become accessible to anyone who guesses or obtains these identifiers through side-channel information leaks, metadata exposure, or other reconnaissance techniques. This effectively neutralizes the confidentiality guarantees provided by marking a repository as private for those specific legacy files.
The technical root cause lies in the application's failure to distinguish between the context of the request URL and the actual ownership context of the resource being accessed. Modern web frameworks often rely on path parameters to determine scope, but security-critical resources like attachments must always be validated against their intrinsic metadata rather than extrinsic routing information. By checking permissions against the repository named in the request URL, Gitea inadvertently treats all requests routed through a public namespace as if they belong to that public context, ignoring the actual location and ownership of the attachment data. This misalignment between logical access control and physical resource identification is a classic example of an insecure direct object reference where the identifier used for access does not correctly map to the intended security policy enforcement point.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in verifying authorization before granting access to resources. Furthermore, it maps to MITRE ATT&CK technique T1078, Valid Accounts, although in this case, no valid account is required for the initial exfiltration due to the unauthenticated nature of the exploit. The attack vector leverages information disclosure principles where knowledge of internal identifiers facilitates unauthorized data retrieval. For organizations using Gitea versions affected by this issue, immediate mitigation involves upgrading to a patched version that corrects the ownership verification logic in the attachment handler. Until an upgrade is performed, administrators should consider restricting public access to repositories containing sensitive attachments or implementing network-level controls such as web application firewalls to monitor and block requests exhibiting patterns consistent with UUID enumeration attacks. Regular audits of repository permissions and minimizing the exposure of internal identifiers through API responses can also reduce the attack surface available to potential adversaries seeking to exploit this logic flaw.