CVE-2026-110311Gitea draft release creation disclosing attachment metadata

Descripción

Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory GHSA-8j56-f865-gqq2 vendor-advisory
• Fix: go-gitea/gitea pull request #39743 patch
• Fix backport to release/v28: go-gitea/gitea pull request #39752 patch
• Gitea 28.2.0 release announcement release-notes
• go-gitea/gitea v28.2.0 release release-notes