31 matches found
CVE-2026-105268 Gitea issue attachment API allows changing comment attachments
The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...
CVE-2026-105268
The Gitea application contains an authorization flaw in its issue attachment API routes (/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}). The vulnerability allows a user who opened an issue to rename or delete attachments that were actually posted in comments by other users. T...
CVE-2026-105268 Gitea issue attachment API allows changing comment attachments
The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...
CVE-2026-105633
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
CVE-2026-105633
The open-source project management tool Plane is vulnerable to an authorization bypass in the V2 issue-attachment PATCH endpoint prior to version 1.4.0 . The root cause is that the server accepts an issue_id in the URL but fails to include it in the database query, matching only on pk, workspace,...
CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
EUVD-2026-92547
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
PT-2026-106080
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue id in the URL but omits it from the database query. A project member can use an issue id they control in the URL while targeting another user's attachment by its pk UUID. Because...
PT-2026-106028
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspace slug/download/asset id/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belong...
CVE-2026-105633: Authorization Bypass Through User-Controlled Key
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content
Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or...
CVE-2021-27733
In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment...
The vulnerabilities of the functions UploadIssueAttachment() and UploadReleaseAttachment() in the software for creating self-managed Git repositories Gogs allow a malicious actor to trigger a service failure and execute arbitrary code.
The vulnerability of the UploadIssueAttachment and UploadReleaseAttachment functions of the Gogs self-managed Git repository creation tool is related to the lack of authentication. Exploiting this vulnerability could allow a malicious actor to cause service failures and execute arbitrary code by...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the UploadIssueAttachment and UploadReleaseAttachment functions, over the /issues/attachments and /releases/attachments endpoints. This is only exploitable if the RequireSigninView setting is disabled, which it...
EUVD-2017-17722
Malware in sbrugna...
CVE-2021-27733
In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment...
