HIGH7.5
GHSA-x92v-f5gc-r34v
Gitea draft releases and attachments are exposed without write permission
Quick fix
GHSA-x92v-f5gc-r34v — code.gitea.io/gitea: upgrade to the fixed version with the command below.
go get code.gitea.io/gitea@v1.25.5Details
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-27660[ADVISORY]
- https://github.com/go-gitea/gitea/pull/36659[WEB]
- https://github.com/go-gitea/gitea/pull/36715[WEB]
- https://github.com/go-gitea/gitea/commit/1eced4a7c099459af42412bb32a83241650c0f8f[WEB]
- https://github.com/go-gitea/gitea/commit/e7fca90a780e4d35eb1fa67b1f377ebd54e74611[WEB]
- https://blog.gitea.com/release-of-1.25.5[WEB]
- https://github.com/go-gitea/gitea[PACKAGE]
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5[WEB]