---
id: CVE-2026-110311
title: Gitea draft release creation disclosing attachment metadata
summary: >-
  Creating a draft release through the API returned an `assets` list that was
  built from a release without an ID, which matched every attachment that was
  not linked to a release. A user who could create a draft release in a
  repository ther…
severity: none
cwe:
  - CWE-200
vendor: Gitea
product: gitea.dev
affected:
  - gitea.dev >= 1.22.0 <= 28.1.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T18:57:14.140Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110311'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-8j56-f865-gqq2'
    label: GitHub Security Advisory GHSA-8j56-f865-gqq2
  - url: 'https://github.com/go-gitea/gitea/pull/39743'
    label: 'Fix: go-gitea/gitea pull request #39743'
  - url: 'https://github.com/go-gitea/gitea/pull/39752'
    label: 'Fix backport to release/v28: go-gitea/gitea pull request #39752'
  - url: 'https://blog.gitea.com/release-of-28.2.0/'
    label: Gitea 28.2.0 release announcement
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v28.2.0'
    label: go-gitea/gitea v28.2.0 release
tags:
  - cve.org
ingestedAt: '2026-10-18T19:51:12.337Z'
---

## Overview

Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.

## Affected

- `gitea.dev >= 1.22.0 <= 28.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.