GHSA-x92v-f5gc-r34v
Gitea draft releases and attachments are exposed without write permission
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | code.gitea.io/gitea | < 1.25.5 | 1.25.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2026-27660
- https://github.com/go-gitea/gitea/pull/36659
- https://github.com/go-gitea/gitea/pull/36715
- https://github.com/go-gitea/gitea/commit/1eced4a7c099459af42412bb32a83241650c0f8f
- https://github.com/go-gitea/gitea/commit/e7fca90a780e4d35eb1fa67b1f377ebd54e74611
- https://blog.gitea.com/release-of-1.25.5
- https://github.com/go-gitea/gitea
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5