Gitea EUVD-2026-103989

The attacker must hold an authenticated account with permission to create a draft release in at least one repository on the target Gitea instance (the create-draft-release API path is the trigger). Exploitation is limited to that authenticated, write-capable context and to default versions in the 1.22.0 through 28.1.0 range; instances on 28.2.0 or later are not affected. The leak is bounded to attachment METADATA only (file name, UUID, upload time, size, download count) of issue/comment attachments and abandoned uploads - not the attachment file contents themselves - so impact is confidentiality-limited and does not expose repository code or write/delete capability.

This is a genuine but low-severity information-disclosure issue, and the multiple signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a remotely reachable, low-complexity flaw that requires an authenticated account (PR:L) and leaks only limited confidentiality (C:L) with no integrity or availability impact - matching the CWE-200 classification and the description precisely. The EPSS score of 0.16% (4th percentile) and CISA SSVC decision (Exploitation: none, Automatable: no, Technical Impact: partial) reinforce low real-world urgency, and the vulnerability is NOT in CISA KEV. No public exploit was identified; the only source code available is the vendor patch (PR #39743/#39752), which is a fix, not a weaponized POC. The net picture is a real but minor priority: it exposes attachment metadata (not file contents) to users who already hold write-level access on the instance, so it is a lateral metadata-leak concern rather than a critical breach. One note for verification: the patch bundle in PR #39743 also contains an unrelated label-deletion authorization refactor (DeleteLabel split into DeleteRepoLabel/DeleteOrgLabel); the attachment leak described by this CVE corresponds specifically to the models/repo/release.go change guarding against releases with ID 0.

An authenticated user with permission to create a draft release in any single repository on a Gitea instance calls the draft-release creation API. Because the server built the attachments query from a release object whose ID was 0, the response matched every attachment not linked to a release, returning the metadata (file name, UUID, upload time, size, download count) of issue and comment attachments from private repositories the user cannot read, plus abandoned uploads. No public exploit code is known, but the attack requires only a normal authenticated API call against the default configuration.