CVE-2026-110311

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110311
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110311.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110311
Aliases
  • GHSA-8j56-f865-gqq2
Published
2026-10-18T18:57:14Z
Modified
2026-10-19T10:45:12Z
Summary
Gitea draft release creation disclosing attachment metadata
Details

Creating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.

Database specific 
{
    "cna_assigner":  "Gitea",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110311.json"
}
References

Affected packages

Git / github.com/go-gitea/gitea

Affected ranges

Type
GIT
Repo
https://github.com/go-gitea/gitea
Events
Introduced
803b0c9ab43f809e47f42fad951e7f5fb6652e42
Last Affected
4ebd5e319b6a9e629bfd7a04292a6fe85b08dee9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.22.0"
        },
        {
            "last_affected":  "28.1.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110311.json"