CVE-2026-57886

Published: Aug 13, 2026Modified: Aug 26, 2026Deferred

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Exploitability: 1.6 / Impact: 4.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Cross-repository issue/comment attachment re-linking can expose private attachment content

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://blog.gitea.com/gitea-1.27.0-is-released/

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/releases/tag/v1.27.0

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/security/advisories/GHSA-6c6r-5xr4-cr5m

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

Timeline

No history available yet.