漏洞信息
# Gitea 跨仓库授权绕过致私有附件泄露
N/A
神龙判断
是否为 Web 类漏洞： 未知
判断理由：
N/A
提示
尽管我们采用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。
神龙会尽力确保数据准确，但也请结合实际情况进行甄别与判断。
神龙祝您一切顺利！
漏洞标题
Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure
漏洞描述信息
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
CVSS信息
N/A
漏洞类别
访问控制不恰当