{"vulnerability": "CVE-2026-78433", "sightings": [{"uuid": "19e3b4da-6b60-4344-9eb2-24a678139b43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78433", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117441101134898278", "content": "CVE-2026-78433 Gitea private attachment disclosure through repository mismatch Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.\nhttps://www.cve.org/CVERecord?id=CVE-2026-78433https://github.com/go-gitea/gitea/security/advisories/GHSA-frpv-2xgv-wxpqhttps://blog.gitea.com/release-of-1.27.3/https://github.com/go-gitea/gitea/pull/39048https://github.com/go-gitea/gitea/pull/39077https://github.com/go-gitea/gitea/releases/tag/v1.27.3#gitea #Gitea#CVE_2026_78433#bot", "creation_timestamp": "2026-10-14T20:16:31.290065Z"}]}