GHSA-4xx9-vc8v-87hv

Source

https://github.com/advisories/GHSA-4xx9-vc8v-87hv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-4xx9-vc8v-87hv/GHSA-4xx9-vc8v-87hv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4xx9-vc8v-87hv

Aliases

Published

2026-01-23T00:31:17Z

Modified

2026-02-03T03:08:45.128827Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Gitea does not properly validate repository ownership when linking attachments to releases

Details

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.

Database specific

{
    "github_reviewed_at": "2026-01-23T20:14:52Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-284"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2026-01-22T22:16:19Z"
}

References

Affected packages

Go / github.com/go-gitea/gitea

Package

Name: github.com/go-gitea/gitea; View open source insights on deps.dev
Purl: pkg:golang/github.com/go-gitea/gitea

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.25.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-4xx9-vc8v-87hv/GHSA-4xx9-vc8v-87hv.json"