https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:48:37.317906+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352801 EUVD-2026-352801 2026-10-04T04:48:37.320733+00:00 EUVD-2026-352801 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57886 fkie_cve-2026-57886 2026-10-04T04:48:37.320765+00:00

Cross-repository issue/comment attachment re-linking can expose private attachment content

 https://cve.radiocsirt.org/vuln/ghsa-6c6r-5xr4-cr5m GHSA-6c6r-5xr4-cr5m — Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content 2026-10-04T04:48:37.320796+00:00

Affected: Go: code.gitea.io/gitea

## Summary

Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or comment, causing later attachment access checks to use the attacker's repository authorization context.

## Affected

- Component: web issue/comment attachment handling. - Confirmed version: `main` commit `a39b2775edcb3ba53def96794491b91335117d81` (`v1.27.0-dev-352-ga39b2775ed`). - Fixed in: not fixed at the time of validation. - Other versions: not exhaustively tested. The affected code path appears structurally similar to versions that contain the current issue/comment attachment update logic.

## Description / Root Cause

`files[]` values from issue/comment edit flows are passed to `updateAttachments` in `routers/web/repo/issue.go:589-629`. That helper calls:

- `models/issues/issue_update.go:267-278` (`UpdateIssueAttachments`) - `models/issues/comment.go:623-642` (`UpdateCommentAttachments`)

Both functions load attachments by UUID and update the attachment linkage, but neither validates that the attachment row's `RepoID` matches the repository of the target issue/comment. They also do not reject attachments already linked to a different issue/comment.

Attachment reads then use the linked issue/release repository to decide access:

- `services/repository/repository.go:185-2…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 WID-SEC-W-2026-2304 — Gitea: Mehrere Schwachstellen 2026-10-04T04:48:37.320856+00:00

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.