CVE-2026-78433: gitea Improper Access Control

Vulnerability summary

CVE-2026-78433 is a medium (CVSS 5.9) Improper Access Control vulnerability in gitea. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 18-10-2026
   Last modifiedVulnerability information updated.

Description

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.