medium
CVE-2026-110311
Gitea before 28.2.0: creating a draft release through the API returns an assets list built from a release with no ID, which matches every attachment not yet linked to a release and leaks other users' uploads
- Severity
- medium
- Affected product
- Gitea
- Affected versions
- Gitea ≥ 1.22.0, < 28.2.0
- Fixed in
- Gitea 28.2.0
- Detection basis
- Component version range
- Shipped rule
- Gitea: Gitea before 28.2.0: creating a draft release through the API returns an assets list built from a release with no ID, which matches every attachment not yet linked to a release and leaks other users' uploads
- Added to NewScan
- 2026-10-19
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Gitea from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.