---
id: CVE-2026-110311
title: Gitea draft release creation disclosing attachment metadata
summary: >-
  Creating a draft release through the API returned an `assets` list that was
  built from a release without an ID, which matched every attachment that was
  not linked to a release. A user who could create a draft release in a
  repository ther…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
vendor: Gitea
product: gitea.dev
affected:
  - gitea.dev >= 1.22.0 <= 28.1.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T20:16:47.677118Z'
published: '2026-10-18'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T20:17:02.703Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110311'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-8j56-f865-gqq2'
    label: GitHub Security Advisory GHSA-8j56-f865-gqq2
  - url: 'https://github.com/go-gitea/gitea/pull/39743'
    label: 'Fix: go-gitea/gitea pull request #39743'
  - url: 'https://github.com/go-gitea/gitea/pull/39752'
    label: 'Fix backport to release/v28: go-gitea/gitea pull request #39752'
  - url: 'https://blog.gitea.com/release-of-28.2.0/'
    label: Gitea 28.2.0 release announcement
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v28.2.0'
    label: go-gitea/gitea v28.2.0 release
tags:
  - cve.org
ingestedAt: '2026-10-18T19:51:12.337Z'
epss: 0.00217
epssPercentile: 0.1212
---

## Overview

Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.

## Affected

- `gitea.dev >= 1.22.0 <= 28.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.