CVE-2026-110311
Medium
Description
Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Gitea
PublishedOct 18, 2026
First seenOct 18, 2026
Weakness typeCWE-200Sensitive information exposure
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Gitea Gitea | 1.22.0 ≤ v ≤ 28.1.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.