https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T13:46:56.543871+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352877 EUVD-2026-352877 2026-10-04T13:46:56.607256+00:00 EUVD-2026-352877 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58432 fkie_cve-2026-58432 2026-10-04T13:46:56.607294+00:00

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

 https://cve.radiocsirt.org/vuln/ghsa-q9pg-jj6x-j9p6 GHSA-q9pg-jj6x-j9p6 — Gitea: draft release attachment disclosure via missing web authorization 2026-10-04T13:46:56.607327+00:00

Affected: Go: code.gitea.io/gitea

### Summary

Gitea's draft-release access control is enforced only on the API release endpoints (`/api/v1/repos/{owner}/{repo}/releases/{id}` and its `/assets/...` sub-routes) but not on the web-level UUID-based attachment endpoints (`/attachments/{uuid}`, `/{owner}/{repo}/attachments/{uuid}`, `/{owner}/{repo}/releases/attachments/{uuid}`). Anyone (including unauthenticated callers) who has, learns, or otherwise obtains the UUID of an attachment belonging to a draft release can download its full contents, despite the draft release itself being correctly hidden from listings and direct-by-ID API lookups.

The `browser_download_url` field returned by the API (visible to anyone with write access to the repo) embeds the UUID. Forwarding this URL by email, log scrape, browser history, screenshot, or any side channel grants any recipient unauthenticated access to the attachment, indefinitely. This is the identical insider-leak threat model that Gitea fixed on the API surface in PR #36659 (CVE-2026-27660, Feb 2026) by adding `canAccessReleaseDraft` checks. The web mirror was missed.

### Details

**Root cause:** the web-side handler `ServeAttachment` (`routers/web/repo/attachment.go:122-203`) checks only repo-level unit-read permission, never the `IsDraft` flag of the linked release:

```go // routers/web/repo/attachment.go:122-203, current implementation func ServeAttachment(ctx *context.Context, uuid string) { attach, err := repo_model.GetAttachmentByUUID(ctx, uuid) if er…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 WID-SEC-W-2026-2304 — Gitea: Mehrere Schwachstellen 2026-10-04T13:46:56.607416+00:00

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.