A writer can create a draft release via the Gitea API, causing the system to generate an "assets" list for a non‑existent release. The list unwittingly includes every attachment that is not linked to an existing release, revealing file names, UUIDs, upload timestamps, sizes, and download counters. This disclosure exposes attachments from issues, comments, and abandoned uploads that the attacker would normally not be able to read, even if the repository is otherwise private or the attachments belong to a different user. The flaw is a classic information‑disclosure weakness (CWE‑200).

The vulnerability affects all installations of Gitea, specifically any repository where a user has permissions to create a draft release. Versions earlier than 28.2.0 are vulnerable; the issue was addressed in the 28.2.0 release. No specific vendor or product name beyond Gitea is listed, so all community‑maintained and enterprise deployments must be examined.

The CVSS score is 4.3, the EPSS score is less than 1% indicating a low probability of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is via the authenticated REST API that accepts draft release creation. An attacker only needs the ability to call this endpoint, which may be granted to maintainers or project members, to obtain metadata beyond their normal read permissions. While no remote code execution or denial of service is reported, the information disclosed can aid further attacks or auditing violations.