The vulnerability occurs when the Gitea API endpoint for issue attachments accepts attachments that belong to comments. An issue author can rename or delete attachments that were originally uploaded by other users as part of a comment. Although the contents of the attachments cannot be replaced, owners of the issue have the ability to remove evidence or manipulate the public record. This is a direct authorization bypass where an attacker with permission to edit an issue can affect the integrity of documents posted by others. The weakness is identified as CWE‑639 and CWE‑863.

Affected systems are instances of Gitea. The flaw was present before the release of version 28.1.0. No specific affected version range is officially provided, but any deployment of Gitea prior to v28.1.0 is vulnerable. The bug was addressed by the Gitea maintainers and a patched release (28.1.0) is available.

The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 4.3, but the impact is limited to modifying the metadata of existing attachments, not to arbitrary code execution or data exfiltration. An attacker requires the ability to edit an issue and the endpoint is exposed over HTTPS, so the attack vector is considered network-based. The likelihood of exploitation is believed to be moderate; defenders should mitigate by applying the latest release as soon as possible.