{"id":"CVE-2026-110311","summary":"Gitea draft release creation disclosing attachment metadata","details":"Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.","aliases":["GHSA-8j56-f865-gqq2"],"modified":"2026-10-19T10:45:12.250004688Z","published":"2026-10-18T18:57:14.140Z","database_specific":{"cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110311.json","cna_assigner":"Gitea"},"references":[{"type":"ADVISORY","url":"https://blog.gitea.com/release-of-28.2.0/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110311.json"},{"type":"FIX","url":"https://github.com/go-gitea/gitea/pull/39743"},{"type":"FIX","url":"https://github.com/go-gitea/gitea/pull/39752"},{"type":"ADVISORY","url":"https://github.com/go-gitea/gitea/releases/tag/v28.2.0"},{"type":"ADVISORY","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8j56-f865-gqq2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110311"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/go-gitea/gitea","events":[{"introduced":"803b0c9ab43f809e47f42fad951e7f5fb6652e42"},{"last_affected":"4ebd5e319b6a9e629bfd7a04292a6fe85b08dee9"}],"database_specific":{"extracted_events":[{"introduced":"1.22.0"},{"last_affected":"28.1.0"}],"source":"AFFECTED_FIELD"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110311.json"}}],"schema_version":"1.9.0"}