Description
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Gitea | Gitea | ≤ 28.0.0 | — |
Advisories 1
- WID-SEC-2026-3792 Gitea: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2026
References
- GitHub Security Advisory GHSA-96qg-qxxj-r8xq vendor-advisory
- Fix: go-gitea/gitea pull request #39501 patch
- Fix backport to release/v28: go-gitea/gitea pull request #39507 patch
- Gitea 28.1.0 release announcement release-notes
- go-gitea/gitea v28.1.0 release release-notes