CVE-2026-57886: Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Gitea’s issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or comment, causing later attachment access checks to use the attacker’s repository authorization context.

Full HTTP/E2E observation:

• A local Gitea server was started with an isolated SQLite database.
• A victim user created private repositories, private issues, and issue attachments containing unique marker strings.
• An attacker user first attempted to download each victim attachment through /attachments/{uuid} and received 404.
• The attacker then submitted the victim UUID through the real issue edit route in an attacker-controlled public repository.
• The same attacker could then download the victim issue attachment through /attachments/{uuid} and received 200; the response body contained the unique issue marker.
• The attacker repeated the flow through the real comment edit route and could download the second victim attachment with 200; the response body contained the unique comment marker.

Model-level issue-path behavior:

• A fixture attachment with RepoID = 2 and IssueID = 4 was passed to UpdateIssueAttachments for attacker issue ID = 1, whose RepoID = 1.
• The call succeeded.
• The attachment row still had RepoID = 2, but its IssueID was changed to the attacker issue.
• GetAttachmentLinkedTypeAndRepoID then resolved the attachment to attacker repository RepoID = 1.

Model-level comment-path behavior:

• The same cross-repository attachment UUID was passed to UpdateCommentAttachments for attacker comment ID = 1.
• The call succeeded.
• The attachment row still had RepoID = 2, but its IssueID and CommentID were changed to the attacker’s issue/comment.
• The linked repository used for access checks became attacker repository RepoID = 1.

Negative control:

• Existing release test TestAddReleaseAttachmentsRejectsDifferentRepo passes and confirms the release path rejects the same class of cross-repository attachment linkage.

Detailed verifier and step-by-step runbook are available on request.