Gitea private attachment disclosure through repository mismatch
CVSS score
—
EPSS probability
—
Risk score
—
Published
14 h ago
Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
2
Source agreement
Tam uyum
Evidence confidence
%63
Short explanation
CVE-2026-78433 stems from improper access control in Gitea's web attachment handler. An unauthenticated attacker who knows a private attachment's UUID can retrieve its contents through a public repository's attachment path.
This vulnerability can expose private issue attachments, pull request attachments, or release assets to unauthorized users.
What should be done?
- Apply the provided patch references and updates
- Upgrade the Gitea software to secure versions
- Review vendor advisory documents
Chain of evidence and sources
Gitea'nın web eki işleyicisi, 16 Ocak 2026 tarihinden önce oluşturulan ekler için çapraz repo sahipliği kontrolünü atlar.
Kimliği doğrulanmamış bir saldırgan, özel bir ekin UUID bilgisini bilerek genel bir deponun ek yolu üzerinden içeriği alabilir.
Show the technical text from the sources
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.
CWE: CWE-284, CWE-639, CWE-863, CWE-1220
Explanation produced with the local gemini-flash-lite-latest model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
Affected Products
The following products are affected by CVE-2026-78433 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | gitea | gitea | View |
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| The sources have not yet published a verified CVSS metric. | ||||
Patch and Remediation Guide
Solution & Remediation Advisory
4 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-78433 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-78433 weaknesses.
Official Sources and Advisories
Similar Vulnerabilities
Code injection in Gitea
Gitea Runner host isolation bypass through container options
Gitea Org-mode file disclosure and code execution
Gitea fork workflow approval bypass through review events
Gitea fork workflow approval bypass through concurrency cancellation
Gitea private comparison disclosure with public-only tokens
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-78433"