CVE-2026-57886

Cross-repository issue/comment attachment re-linking can expose private attachment content...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the attachment update. An attacker can access private attachment content by re-linking a known attachment UUID to an issue or comment in a repository they control, causing authorization checks to be performed...