Gitea Attachment Re-linking Issue: Potential Exposure of Private Content
An issue in Gitea's issue and comment attachment update paths may allow authenticated attackers to re-link attachments across repositories, potentially exposing private content.
What happened
Gitea's issue and comment attachment update paths reportedly accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. This vulnerability appears to allow an authenticated attacker, who knows a victim's attachment UUID, to re-link that attachment to an attacker-controlled issue or comment. Consequently, later attachment access checks may use the attacker's repository authorization context, potentially exposing private content. This issue is under investigation and has been tracked under the ID GHSA-6C6R-5XR4-CR5M.
Professional software engineers using Gitea should assess their exposure by reviewing their current version against the affected component: gitea (go) main commit a39b2775edcb3ba53def96794491b91335117d81 (v1.27.0-dev-352-ga39b2775ed). It is recommended to upgrade to a version of Gitea that includes the fix for this issue, or apply the fix manually if possible. For more detailed information, primary sources should be consulted.
How 0Day mitigates this
gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.