CVE-2026-110311 Gitea CVE debrief

Who should care

Gitea instance administrators and users with draft release creation capabilities should assess their exposure to this vulnerability and prioritize applying patches or mitigating controls.

Why it matters

Defenders should care about this vulnerability because it allows users with draft release creation capabilities to obtain metadata of attachments they cannot read, potentially leading to unauthorized access to sensitive information. Gitea instance administrators should verify exposure, assess impact, and prioritize patching or mitigating controls to prevent exploitation.

• Potential metadata disclosure of sensitive issue and comment attachments.
• Possible unauthorized access to abandoned upload information.
• Need for verification of Gitea instance exposure and user access controls.
• Priority for applying patches or mitigating controls to prevent exploitation.

Technical summary

The vulnerability occurs when creating a draft release through the API, which returns an `assets` list built from a release without an ID. This list includes metadata of issue and comment attachments from repositories the user cannot read, as well as abandoned uploads. The metadata disclosed includes file names, UUIDs, upload times, sizes, and download counts. This issue allows users with draft release creation capabilities to obtain metadata of attachments they cannot read, potentially leading to unauthorized access to sensitive information.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their Gitea instances, especially those with users who can create draft releases.

Recommended defensive actions

• Verify Gitea instance exposure to this vulnerability, especially for users with draft release creation capabilities.
• Assess the impact of potential metadata disclosure on the organization.
• Apply patches from Gitea pull requests #39743 and #39752 or upgrade to Gitea version 28.2.0 or later.
• Monitor Gitea instance logs for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about this vulnerability. Vendor advisories and patch information are available through GitHub Security Advisory GHSA-8j56-f865-gqq2 and Gitea pull requests #39743 and #39752.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.