CVE-2026-57886

CVE-2026-57886 describes a data-leak risk in Gitea’s handling of issue/comment attachments. The root cause is that when re-linking attachments via issue or comment edits, the code paths UpdateIssueAttachments and UpdateCommentAttachments load attachments by UUID but do not validate that the attac...

GO-2026-6035 Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content in gitea.dev

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content in gitea.dev...