CVE-2026-78433: 
Gitea vulnerability analysis and mitigation

CVE-2026-78433 is a cross-repository attachment disclosure vulnerability in Gitea's web attachment handler that allows unauthenticated attackers to retrieve private repository attachments by routing requests through a public repository's attachment path. It affects Gitea versions 1.26.0 through 1.27.2 (inclusive) and was disclosed on October 14, 2026, with a patch available in version 1.27.3. The vulnerability has a CVSS v3.1 base score of 5.9 (Medium) (Gitea Security Advisory, GitHub Advisory).

The root cause lies in routers/web/repo/attachment.go, where the cross-repository ownership check is gated solely on the attachment's creation timestamp: attachments created before January 16, 2026 bypass the check entirely (CWE-284, CWE-639, CWE-863, CWE-1220). When the guard is skipped, the handler evaluates permissions against the repository named in the request URL rather than the repository that actually owns the attachment. Because a database migration backfills the owning repository ID on upgrade, the timestamp-only exemption protects no legitimate rows and instead allows any public repository's attachment path to serve private attachments. The attachment endpoint permits anonymous access, so no authentication is required; the only precondition is that the attacker already knows the target attachment's random UUID (Gitea Security Advisory, Fix PR #39048).

Successful exploitation results in unauthorized disclosure of private-repository attachment contents — including issue attachments, pull request attachments, and release assets — to any unauthenticated caller. There is no integrity or availability impact; the vulnerability is purely a confidentiality breach. Sensitive data such as source code archives, configuration files, or internal documents attached to private issues or releases could be exposed if an attacker obtains the relevant attachment UUID (Gitea Security Advisory).

No public proof-of-concept exploit code is known to exist, and there is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained by the requirement that the attacker already possess a valid attachment UUID, which could be obtained through prior access (e.g., removed collaborator), notification emails, webhook payloads, or proxy/CDN logs (Gitea Security Advisory, GitHub Advisory).

1. Obtain a target attachment UUID: Acquire the UUID of a private repository attachment through a prior access vector — for example, from notification emails, webhook payloads, proxy/CDN logs, or access retained from a period when the attacker was a collaborator on the private repository.
2. Identify a public repository on the same Gitea instance: Find any publicly accessible repository hosted on the vulnerable Gitea instance (versions 1.26.0–1.27.2).
3. Craft a cross-repository attachment request: Construct an HTTP GET request using the public repository's attachment path but substituting the private attachment's UUID, e.g., GET /[public-owner]/[public-repo]/attachments/[private-attachment-UUID].
4. Retrieve the private attachment: Because the handler skips the cross-repository ownership check for attachments created before January 16, 2026, and evaluates permissions against the public repository (which is accessible), the server returns the private attachment's contents without requiring authentication (Gitea Security Advisory, Fix PR #39048).

• Network: Unexpected HTTP GET requests to /<public-owner>/<public-repo>/attachments/<UUID> where the UUID does not correspond to any attachment belonging to the requested public repository; anonymous (unauthenticated) requests to attachment endpoints for repositories that do not own the referenced UUID.
• Logs: Gitea access logs showing attachment download requests from unauthenticated clients referencing UUIDs associated with private repositories; repeated attachment access attempts across different public repository paths using the same UUID.
• Application Behavior: Successful 200 responses to attachment requests routed through a public repository path for attachments that belong to a private repository, particularly for attachments with creation timestamps predating January 16, 2026.

Upgrade Gitea to version 1.27.3 or later, which enforces the owning repository path for all attachment requests regardless of creation timestamp (fixes #39048 and #39077). No configuration-based workaround is available; upgrading is the only remediation. Administrators should also review attachments created before January 16, 2026 in private repositories for potential unauthorized access, and consider re-uploading sensitive attachments if exposure is suspected (Gitea Release v1.27.3, Gitea Security Advisory).

The Gitea project published a security advisory (GHSA-frpv-2xgv-wxpq) crediting reporter iabdullah215 and remediation developer bircni. The fix was included as part of the broader Gitea 1.27.3 security release, which addressed multiple access control issues simultaneously. The release received positive community reception on GitHub with 45 reactions on the release notes (Gitea Release v1.27.3, Gitea Security Advisory).