The flaw lies in the web attachment handler that bypasses cross‑repository ownership validation for attachments created before 16 January 2026. Instead of checking the original repository of the attachment, the system validates permissions against the repository specified in the request URL. An unauthenticated attacker who knows the UUID of a private attachment can therefore request it through a public repository’s attachment path and receive its contents. As a result, issue and pull request attachments or release assets that were previously hidden can be disclosed.

The vulnerability affects the open‑source project Gitea. Any installation running a version prior to the 1.27.3 release is susceptible. The security advisory specifically references the 1.27.3 update that addresses the file‑ownership check bug.

Based on the provided metrics, the EPSS score is reported as less than 1 %, indicating that the probability of exploitation is very low but non‑zero. The vulnerability is not listed in the CISA KEV catalog, and a CVSS score of 5.9 indicates moderate risk. The attack requires only a valid UUID and a public repository path – both of which can be discovered or guessed. The attack is remote, unauthenticated, and does not require elevated system privileges. The most likely attack vector is a simple HTTP GET request to the attachment URL. The exposure is limited to previously uploaded private assets whose identifiers are known, but the scope of potential leakage is large because many teams use private attachments in issues, PRs, and releases.