CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2025-54730"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-14T19:15:38Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in PARETO Digital Embedder for Google Reviews allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Embedder for Google Reviews: from n/a through 1.7.3.",
  "id": "GHSA-q9g8-m5qg-wx43",
  "modified": "2026-04-01T18:35:52Z",
  "published": "2025-08-14T21:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54730"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/embedder-for-google-reviews/vulnerability/wordpress-embedder-for-google-reviews-plugin-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5459"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-05T13:15:13Z",
    "severity": "MODERATE"
  },
  "details": "The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on \u0027add_section\u0027, \u0027add_menu\u0027, \u0027add_menu_item\u0027, and \u0027add_menu_page\u0027 functions in all versions up to, and including, 2.4.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create menu sections, menus, food items, and new menu pages.",
  "id": "GHSA-q9gh-wgf2-5fp3",
  "modified": "2024-06-05T15:30:39Z",
  "published": "2024-06-05T15:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5459"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L111"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L144"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L62"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L80"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3097599"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03f9d9bb-6a87-4da9-bbb0-65203d7250e9?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.meowlomo.jenkins:scm-httpclient"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-41250"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-23T12:57:46Z",
    "nvd_published_at": "2022-09-21T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "SCM HttpClient Plugin 1.5 and earlier does not perform permission check in a method implementing form validation.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.\n\nAdditionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.",
  "id": "GHSA-q9j5-2mjx-8x28",
  "modified": "2022-12-09T20:14:11Z",
  "published": "2022-09-22T00:00:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41250"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/scm-httpclient-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2708"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/09/21/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Missing permission check in Jenkins SCM HttpClient Plugin allow capturing credentials"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-48117"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-16T16:15:43Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in kilbot WooCommerce POS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce POS: from n/a through 1.7.8.",
  "id": "GHSA-q9j8-hx2p-36g7",
  "modified": "2026-04-01T18:35:07Z",
  "published": "2025-05-16T18:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48117"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/woocommerce-pos/vulnerability/wordpress-woocommerce-pos-1-7-8-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-1777"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-06T06:15:31Z",
    "severity": "MODERATE"
  },
  "details": "The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the \u0027ux_cb_page_options_save\u0027 function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
  "id": "GHSA-q9jq-f2hm-mq6f",
  "modified": "2025-06-06T06:30:26Z",
  "published": "2025-06-06T06:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1777"
    },
    {
      "type": "WEB",
      "url": "https://www.seatheme.net"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb3e0251-c3b7-4360-87f3-7e4612d4f285?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-4686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-22T16:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.",
  "id": "GHSA-q9mg-8x46-h8mx",
  "modified": "2023-11-22T18:30:55Z",
  "published": "2023-11-22T18:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4686"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-customer-reviews/trunk/include/admin/wp-customer-reviews-3-admin.php?rev=2617376#L866"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2965656/wp-customer-reviews/trunk?contextall=1\u0026old=2882143\u0026old_path=%2Fwp-customer-reviews%2Ftrunk"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/24b9984c-ec33-4492-815b-67a21ac4da0e?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-18996"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-02-05T18:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the server.",
  "id": "GHSA-q9mp-cgfx-mqjr",
  "modified": "2022-05-13T01:33:40Z",
  "published": "2022-05-13T01:33:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18996"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/106634"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-31909"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-03T14:15:43Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization vulnerability in NotFound Apptivo Business Site CRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Apptivo Business Site CRM: from n/a through 5.3.",
  "id": "GHSA-q9p4-73jm-wjh3",
  "modified": "2026-04-01T18:34:28Z",
  "published": "2025-04-03T15:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31909"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/apptivo-business-site/vulnerability/wordpress-apptivo-business-site-crm-plugin-5-3-arbitrary-content-deletion-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/goharbor/harbor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-13794"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-24T12:51:00Z",
    "nvd_published_at": "2020-09-30T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### **Impact**\n\nHidde Smit from Cyber Eagle has discovered an User Enumeration flaw in Harbor. The issue is present in the \"/users\" api endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained via the \"search\" functionality.\n\nNon-administrator users (such as those created via self-registration) can list all usernames and user IDs by sending a GET request to /api/users/search with parameter \"username\" and value \"_\", as follows:\n\n`curl -X GET \"https://\u003chost\u003e/api/users/search?username=_\" -H \"accept: application/json\" --user \u003cuser\u003e:\u003cpassword\u003e`\n\nThe vulnerability was immediately fixed by the Harbor team and all supported versions were patched. With the patched versions of Harbor, the username is required for search and we have removed the support for querying by email.\n\n### **Patches**\nIf your product uses the affected releases of Harbor, update to either version 2.1.0 or 2.0.3 to fix this issue immediately\n\nhttps://github.com/goharbor/harbor/releases/tag/v2.1.0\nhttps://github.com/goharbor/harbor/releases/tag/v2.0.3\n\n### **Workarounds**\nThere is no workaround for this issue\n\n### **For more information**\nIf you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io\nView our security policy at https://github.com/goharbor/harbor/security/policy\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13794",
  "id": "GHSA-q9p8-33wc-h432",
  "modified": "2022-10-05T17:58:07Z",
  "published": "2021-05-24T16:58:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/goharbor/harbor/security/advisories/GHSA-q9p8-33wc-h432"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13794"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/goharbor/harbor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/goharbor/harbor/releases"
    },
    {
      "type": "WEB",
      "url": "https://github.com/goharbor/harbor/releases/tag/v2.0.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/goharbor/harbor/releases/tag/v2.1.0"
    },
    {
      "type": "WEB",
      "url": "https://www.cybereagle.io/blog/cve-2020-13794"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authenticated users can exploit an enumeration vulnerability in Harbor"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58432"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639",
      "CWE-732",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T20:19:25Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nGitea\u0027s draft-release access control is enforced only on the API release endpoints (`/api/v1/repos/{owner}/{repo}/releases/{id}` and its `/assets/...` sub-routes) but not on the web-level UUID-based attachment endpoints (`/attachments/{uuid}`, `/{owner}/{repo}/attachments/{uuid}`, `/{owner}/{repo}/releases/attachments/{uuid}`). Anyone (including unauthenticated callers) who has, learns, or otherwise obtains the UUID of an attachment belonging to a draft release can download its full contents, despite the draft release itself being correctly hidden from listings and direct-by-ID API lookups.\n\nThe `browser_download_url` field returned by the API (visible to anyone with write access to the repo) embeds the UUID. Forwarding this URL by email, log scrape, browser history, screenshot, or any side channel grants any recipient unauthenticated access to the attachment, indefinitely. This is the identical insider-leak threat model that Gitea fixed on the API surface in PR #36659 (CVE-2026-27660, Feb 2026) by adding `canAccessReleaseDraft` checks. The web mirror was missed.\n\n### Details\n\n**Root cause:** the web-side handler `ServeAttachment` (`routers/web/repo/attachment.go:122-203`) checks only repo-level unit-read permission, never the `IsDraft` flag of the linked release:\n\n```go\n// routers/web/repo/attachment.go:122-203, current implementation\nfunc ServeAttachment(ctx *context.Context, uuid string) {\n    attach, err := repo_model.GetAttachmentByUUID(ctx, uuid)\n    if err != nil { ... }\n\n    // cross-repo guard (only fires when accessed via repo-scoped URL)\n    if attach.CreatedUnix \u003e repo_model.LegacyAttachmentMissingRepoIDCutoff \u0026\u0026\n       ctx.Repo.Repository != nil \u0026\u0026 ctx.Repo.Repository.ID != attach.RepoID {\n        ctx.HTTPError(http.StatusNotFound)\n        return\n    }\n\n    unitType, repoID, err := repo_service.GetAttachmentLinkedTypeAndRepoID(ctx, attach)\n    if unitType == unit.TypeInvalid {\n        if !(ctx.IsSigned \u0026\u0026 attach.UploaderID == ctx.Doer.ID) {\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n    } else {\n        var perm access_model.Permission\n        // ... resolves repo perm\n        if !perm.CanRead(unitType) {       // \u003c-- ONLY check\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n        // NO release.IsDraft check\n        // NO canAccessReleaseDraft equivalent\n    }\n    // ... serves the file\n}\n```\n\nThe helper `GetAttachmentLinkedTypeAndRepoID` (`services/repository/repository.go:185-207`) returns `(unit.TypeReleases, rel.RepoID)` for release-linked attachments but discards the release object (including its `IsDraft` flag) before returning.\n\n**Mounted routes affected** (all reach `ServeAttachment` via `GetAttachment`):\n\n| File:line | Route | Auth gate |\n|---|---|---|\n| `routers/web/web.go:874` | `GET /attachments/{uuid}` (top-level) | `optionsCorsHandler() + webAuth.AllowBasic + webAuth.AllowOAuth2`, accepts anonymous |\n| `routers/web/web.go:1284` | `GET /{owner}/{repo}/attachments/{uuid}` (issue-context) | repo context, anonymous OK |\n| `routers/web/web.go:1473` | `GET /{owner}/{repo}/releases/attachments/{uuid}` (release-context) | `webAuth.AllowBasic + webAuth.AllowOAuth2`, anonymous OK |\n| `routers/web/web.go:1491` | `GET /{owner}/{repo}/attachments/{uuid}` (legacy compatibility) | `webAuth.AllowBasic + webAuth.AllowOAuth2`, anonymous OK |\n\n**Reference: existing fix on the API surface (PR #36659, commit `1eced4a7c0`, Feb 22 2026):**\n\n```go\n// routers/api/v1/repo/release.go:24-37, added by PR #36659\nfunc canAccessReleaseDraft(ctx *context.APIContext) bool {\n    if !ctx.IsSigned || !ctx.Repo.Permission.CanWrite(unit.TypeReleases) {\n        return false\n    }\n    // ... API-token scope check\n}\n```\n\n`canAccessReleaseDraft` is called from `GetRelease` (line 80), `ListReleases` (line 178), `GetReleaseAttachment` (`release_attachment.go:37`), and `ListReleaseAttachments` (line 148). Every API code path now gates draft visibility on **write access**. The web-side `ServeAttachment` was not updated; it continues to gate only on **read access**, allowing anonymous and non-collaborator reads.\n\n**Suggested patch** at `routers/web/repo/attachment.go:166-172`, extending the existing permission check to also gate draft releases on write access:\n\n```go\n} else { // linked attachment\n    var perm access_model.Permission\n    if ctx.Repo.Repository == nil {\n        repo, err := repo_model.GetRepositoryByID(ctx, repoID)\n        if err != nil { ... }\n        perm, err = access_model.GetDoerRepoPermission(ctx, repo, ctx.Doer)\n        if err != nil { ... }\n    } else {\n        perm = ctx.Repo.Permission\n    }\n\n    if !perm.CanRead(unitType) {\n        ctx.HTTPError(http.StatusNotFound)\n        return\n    }\n\n    // NEW: if linked to a draft release, require write access to releases\n    if unitType == unit.TypeReleases \u0026\u0026 attach.ReleaseID != 0 {\n        rel, err := repo_model.GetReleaseByID(ctx, attach.ReleaseID)\n        if err == nil \u0026\u0026 rel.IsDraft \u0026\u0026 !perm.CanWrite(unit.TypeReleases) {\n            ctx.HTTPError(http.StatusNotFound)\n            return\n        }\n    }\n}\n```\n\nAlternatively, `GetAttachmentLinkedTypeAndRepoID` could return the linked release object so the caller does not need a second DB read.\n\n### PoC\n\nTested against `v1.27.0+dev-228-ga564f0587a` (commit `a564f0587a`), default configuration, local-storage attachments.\n\n**Setup:**\n- `alice` owns public repo `alice/alice-pub`\n- `carol` is a registered user with no relationship to `alice` (no collaboration, no org membership)\n\n**Step 1: alice creates a confidential draft release and uploads a sensitive file:**\n\n```bash\n$ DRAFT=$(curl -s -H \"Authorization: token $ALICE_TOKEN\" -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"tag_name\":\"v1.0-CONFIDENTIAL\",\"target_commitish\":\"main\",\n         \"name\":\"INTERNAL PREVIEW\",\"body\":\"unreleased build\",\n         \"draft\":true,\"prerelease\":false}\u0027 \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases)\n$ DID=$(echo \"$DRAFT\" | jq -r .id)         # e.g. 15\n\n$ echo \"TOP_SECRET_BUILD_ARTIFACT\" \u003e confidential.txt\n$ ATT=$(curl -s -H \"Authorization: token $ALICE_TOKEN\" \\\n    -F \"attachment=@confidential.txt;filename=confidential.txt\" \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases/$DID/assets)\n$ UUID=$(echo \"$ATT\" | jq -r .uuid)\n$ ATT_ID=$(echo \"$ATT\" | jq -r .id)\n# UUID: a4701819-6f12-42e4-82fb-14b2a1191e8a\n# browser_download_url returned: http://127.0.0.1:3000/attachments/\u003cUUID\u003e\n```\n\n**Step 2: non-collaborator carol cannot see the draft via the API (correct):**\n\n```bash\n$ curl -s -o /dev/null -w \u0027%{http_code}\\n\u0027 \\\n    -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/api/v1/repos/alice/alice-pub/releases/$DID/assets/$ATT_ID\n404\n```\n\n**Step 3: but carol (and even anonymous callers) CAN download via UUID-based web endpoints:**\n\n```bash\n# (C) carol, top-level\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK, full content\n\n# (D) carol, repo-scoped legacy\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/alice/alice-pub/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n\n# (E) carol, release-scoped web\n$ curl -s -H \"Authorization: token $CAROL_TOKEN\" \\\n    http://127.0.0.1:3000/alice/alice-pub/releases/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n\n# (G) anonymous, top-level (NO auth header)\n$ curl -s http://127.0.0.1:3000/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK, no auth needed at all\n\n# (H) anonymous, repo-scoped legacy\n$ curl -s http://127.0.0.1:3000/alice/alice-pub/attachments/$UUID\nTOP_SECRET_BUILD_ARTIFACT          # \u003c-- 200 OK\n```\n\n**Verdict matrix:**\n\n| Endpoint | Carol (auth, non-collab) | Anonymous |\n|---|---|---|\n| API `/api/v1/.../releases/{id}/assets/{aid}` | 404 (gated) | 404 (gated) |\n| API `/api/v1/.../releases/{id}/assets` | 404 (gated) | 404 (gated) |\n| Web `/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `/{owner}/{repo}/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `/{owner}/{repo}/releases/attachments/{uuid}` | **200 LEAKS** | **200 LEAKS** |\n| Web `browser_download_url` (as returned by API) | **200 LEAKS** | **200 LEAKS** |\n\n### Impact\n\n**Vulnerability class:** Missing authorization (CWE-862) on a parallel code path that was overlooked when the same authorization check was added in a separate handler. This is an **incomplete fix for CVE-2026-27660**.\n\n**Why this is an exploitable vulnerability, not a \"configure it differently\" issue:**\n\nThe Gitea draft-release feature exists for exactly one purpose: stage release content that is not yet meant to be public. The fix in PR #36659 (CVE-2026-27660) explicitly stated *\"Draft release and its attachments need a write permission to access\"* and accordingly gated `GET /api/v1/repos/.../releases/{id}` and `GET /api/v1/repos/.../releases/{id}/assets/{aid}` behind `canAccessReleaseDraft`. The web-side `ServeAttachment` handler (which is reachable from three separate routes on the same host as the API and serves the same underlying attachment object) was not updated. The result is that the security promise communicated to operators (\"draft attachments are visible only to repo writers\") is silently false on the web URLs that the API itself hands out in `browser_download_url`.\n\nThe maintainer cannot reframe this as \"UUID is a capability token\" because Gitea has already explicitly **rejected** that model on the API surface for this exact resource class two months ago. The threat model is identical; only the handler is different.\n\n**Real-world content that leaks under this bug:**\n\nDraft releases are routinely used to stage:\n\n- **Pre-release signed binaries** (Windows MSIs, macOS notarized DMGs, Linux RPM/DEB) before publication: unauthenticated download of unannounced builds.\n- **Security-fix release candidates**: pre-disclosure window for downstream patching, exploitable if the binary diff reveals the bug.\n- **Internal SBOMs, signing manifests, third-party license bundles**: supply-chain reconnaissance.\n- **Release-key public-blob bundles, attestation files**: key-rotation tracking by external observers.\n- **Build artifacts pinned to draft tags by CI pipelines that publish-on-merge**: access to artifacts the release engineer hasn\u0027t decided to ship.\n- **CHANGELOG / release-notes drafts**: pre-disclosure of upcoming features or vulns.\n\nThese are not hypothetical use cases. They are the documented and intended use of the draft-release feature on every git forge.\n\n**Realistic attack scenarios (insider-leak threat model, same as CVE-2026-27660):**\n\n1. **Browser-UI \"Copy link\" causes the URL to leave the trust boundary.** A release engineer is preparing the next release and copies the `browser_download_url` to test the binary on a fresh VM, then pastes it into a Slack thread, a Jira ticket, an email to QA, or a commit message (\"`# binary: $URL`\"). Anyone who later reads that channel (including ex-employees, contractors who lost write access, or anyone scraping public Slack archives) has anonymous, unauthenticated, indefinite access to the draft binary.\n\n2. **Reverse-proxy or observability stack records the URL.** nginx, Caddy, HAProxy, Cloudflare, Datadog, Splunk, ELK: any HTTP-instrumentation pipeline records request paths. Anyone with log read access can extract UUIDs and pull the underlying attachment without authenticating to Gitea at all. For ELT pipelines that copy logs to cloud buckets or data lakes, that read access can be very broad.\n\n3. **Browser history, Referer, extension telemetry.** Once an authorized user downloads a draft attachment, the UUID-bearing URL lives in browser history, optional cloud-synced history (Chrome Sync, Edge Sync, Firefox Sync, recoverable on any signed-in device), browser extension telemetry, and any `Referer` header sent if the URL is loaded in a frame or via an inline asset.\n\n4. **Search-engine and mirror indexing.** Internal portals, asset inventories, dependency scanners, and SaaS supply-chain tools that follow `browser_download_url` to index release artifacts will index the draft URL just like a published one. Once indexed, the URL is discoverable for as long as the index lives.\n\n5. **Embedded links in public content.** A draft-release-attachment URL pasted into an issue comment, a PR description, a wiki page, or a README is rendered as a clickable `\u003ca href\u003e` to any reader of that public page. Readers don\u0027t see the draft release itself but get the attachment behind the link they click.\n\n**Severity calibration via direct precedent:**\n\n| Property | CVE-2026-27660 (this finding\u0027s API mirror) | This finding |\n|---|---|---|\n| Vulnerability class | Missing authorization on draft release | Missing authorization on draft release attachments |\n| Attack vector | Network | Network |\n| Privileges required | None (relies on UUID/ID being leaked) | None (relies on UUID being leaked) |\n| Attack complexity | High (must obtain UUID/ID) | High (must obtain UUID) |\n| Confidentiality | High | High |\n| Integrity / Availability | None | None |\n| Fix complexity | ~5-line authz check added at handler entry | ~5-line authz check added at handler entry |\n| Severity assigned by upstream | Medium | **Should be Medium (5.9) by direct precedent** |\n\nIf CVE-2026-27660 was accepted as a Medium-severity security advisory worth a dedicated PR, an identical bug in the web mirror of the same data is also Medium-severity. The maintainer cannot consistently rate this lower without retroactively downgrading their own previous fix.\n\n**CVSS 3.1:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` = **5.9 / Medium**\n\n- `AV:N`: reachable over the network.\n- `AC:H`: attacker must obtain the UUID via a leak channel (same prerequisite class as the upstream CVE).\n- `PR:N`: no authentication required (anonymous works).\n- `UI:N`: no user interaction required.\n- `S:U`: scope unchanged (still bounded to Gitea\u0027s auth boundary; the draft release was supposed to be inside that boundary but isn\u0027t).\n- `C:H`: full confidentiality breach of the attachment contents.\n- `I:N` / `A:N`: read-only.\n\n**Out of scope:** brute-forcing the UUID is infeasible (122 bits of UUIDv4 entropy). This is a confidentiality-loss bug, not an integrity or availability bug.\n\n**Deployment scale:** Gitea is a top-three self-hosted forge (~30 k+ public Internet-reachable instances per Shodan, plus very large numbers of internal corporate deployments and Codeberg / Forgejo derivatives that inherit the same code). The bug is present in the default configuration; no operator action is required to make a deployment vulnerable.\n\n**Fix complexity:** trivial. Add a `release.IsDraft \u0026\u0026 !perm.CanWrite(unit.TypeReleases)` check in `ServeAttachment` (single function, ~5 lines added). Patch is provided in the Details section. No data migration, no UX change, no breaking-API change.",
  "id": "GHSA-q9pg-jj6x-j9p6",
  "modified": "2026-07-21T20:19:25Z",
  "published": "2026-07-21T20:19:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-q9pg-jj6x-j9p6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38318"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38325"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/ab10e37acf7fabf7829a485cc3e13d118638a856"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/f7fd51022495737cf960b8c4053a27d69148f664"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gitea: draft release attachment disclosure via missing web authorization"
}