CVE-2026-110311

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110311
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110311.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110311
Aliases
  • GHSA-8j56-f865-gqq2
Published
2026-10-18T18:57:14Z
Modified
2026-10-28T02:30:28Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Gitea draft release creation disclosing attachment metadata
Details

Creating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.

Database specific 
{
    "cna_assigner": "Gitea",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110311.json"
}
References

Affected packages

Git / github.com/go-gitea/gitea

Affected ranges

Type
GIT
Repo
https://github.com/go-gitea/gitea
Events
Introduced
d7f73a1334ab7a97d4e055b7c58cdd9ac303f77a
Fixed
829b49c1ae96015e345f9d2a0eb1ea7acd5f31e1
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.22.0"
                },
                {
                    "last_affected": "28.1.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "v28.2.0",
            "range": [
                {
                    "fixed": "829b49c1ae96015e345f9d2a0eb1ea7acd5f31e1"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.22.0-dev
v1.22.0-rc0
v1.22.0-rc1
v1.23.0-dev
v1.24.0-dev
v1.25.0-dev
v1.26.0-dev
v1.27.0-dev
v1.28.0-dev
v28.*
v28.0.0
v28.1.0
v29.*
v29.0.0-dev

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110311.json"