CVE-2026-78433— Gitea private attachment disclosure through repository mismatch
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment'
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78433
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea private attachment disclosure through repository mismatch
Source: CVE Program / CVE List V5
Vulnerability Description
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-78433
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78433
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-78433 (2)
Other References for CVE-2026-78433 (2)
-
Release v1.27.3 · go-gitea/gitea · GitHub release-notes
Other References for CVE-2026-78433 (1)
-
https://blog.gitea.com/release-of-1.27.3/ release-notes
Same Patch Batch · Gitea · 2026-10-14 · 36 CVEs total
| CVE-2026-62925 | Gitea Alpine package parsing memory exhaustion | |
| CVE-2026-70407 | Gitea organization listing token scope bypass | |
| CVE-2026-70396 | Gitea organization repository creation token scope bypass | |
| CVE-2026-70406 | Gitea private comparison disclosure with public-only tokens | |
| CVE-2026-70400 | Gitea private migration creation with public-only tokens | |
| CVE-2026-70402 | Gitea local code execution through writable Git hooks | |
| CVE-2026-67577 | Gitea restricted-user activity and heatmap disclosure | |
| CVE-2026-63792 | Gitea private reusable workflow disclosure to fork runs | |
| CVE-2026-63021 | Gitea Swift package manifest memory exhaustion | |
| CVE-2026-59774 | Gitea Org-mode file disclosure and code execution | |
| CVE-2026-68964 | Gitea restricted-user SSH and GPG key metadata disclosure | |
| CVE-2026-68957 | Gitea restricted-user issue search disclosure | |
| CVE-2026-73814 | Gitea repository ownership escalation by administrators | |
| CVE-2026-73800 | Gitea reusable workflow secret exposure in pull_request_target | |
| CVE-2026-73535 | Gitea second-factor bypass through OpenID identity linking | |
| CVE-2026-73804 | Gitea API token scope escalation through HTTP signatures | |
| CVE-2026-73539 | Gitea external renderer argument injection and code execution | |
| CVE-2026-78231 | Gitea blind SSRF through OpenID assertion verification | |
| CVE-2026-73130 | Gitea repository initialization resource exhaustion | |
| CVE-2026-73802 | Gitea Runner host isolation bypass through container options |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73800
Gitea reusable workflow secret exposure in pull_request_targ -
CVE-2026-73539
Gitea external renderer argument injection and code executio
Same vendor: Gitea
-
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73802
Gitea Runner host isolation bypass through container options -
CVE-2026-73800
Gitea reusable workflow secret exposure in pull_request_targ
Same weakness: CWE-284
-
CVE-2026-55387
InvoiceShelf bulk deletion lacks company scoping -
CVE-2026-55384
InvoiceShelf trusts client-supplied document totals -
CVE-2026-77371
Redash: DuckDB query runner allows arbitrary file read/write -
CVE-2026-66874
Gitea required Actions check bypass through skipped workflow -
CVE-2026-66849
Gitea restricted-user package visibility bypass
V. Comments for CVE-2026-78433
No comments yet