CVE-2026-78433

The Gitea web attachment handler contains an authorization bypass where it skips cross-repository ownership checks for attachments created before 16 January 2026 . Due to this flaw, an unauthenticated attacker who knows a private attachment's UUID can retrieve it by requesting it through a public...