A write‑access user on Gitea releases can, by knowing an attachment’s UUID, link that attachment to a release. This action reveals the file name, size, and download count through the release, and gives the user further rights to rename or delete the attachment. The flaw therefore allows an authorized user to gather sensitive attachment information and potentially alter or remove attachments that should not be exposed.

The vulnerability affects Gitea repositories. Any deployment running a Gitea version before the 28.2.0 release is susceptible until patched.

The exploit requires the attacker to have write permission to a repository’s releases, a privilege commonly granted to repository maintainers or trusted collaborators. Because the flaw relies on knowledge of an attachment UUID, the attack is limited to internal or credentialed users. The EPSS score is very low (<1%) and the vulnerability is not listed in CISA KEV. The CVSS score of 6.3 indicates moderate severity. Nonetheless, the potential for data leakage and unauthorized modification of attachments elevates the risk to moderate or high in environments where release writers manage sensitive assets.