CVE-2026-110311
Last modified
CVE-2026-110311 is a vulnerability of currently unknown severity. Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads..
Description
Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Gitea | Gitea | >= 1.22.0, <= 28.1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-110311?
How severe is CVE-2026-110311?
How do I fix CVE-2026-110311?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11029Insufficient validation of untrusted input in Drag and Drop …9.6
- CVE-2026-110290The WebberZone Top 10 — Popular Posts plugin for WordPress i…6.4
- CVE-2026-1103The AIKTP plugin for WordPress is vulnerable to unauthorized…5.4
- CVE-2026-11030Use after free in Network in Google Chrome prior to 149.0.78…8.8
- CVE-2026-11031Insufficient validation of untrusted input in Password Manag…4.3
- CVE-2026-110310A remote user who can read encrypted objects in the S3 bucke…5.3
- CVE-2026-11032Inappropriate implementation in Password Manager in Google C…6.5
- CVE-2026-110324The visibility check of Gitea user profiles was applied to G…
- CVE-2026-11033Uninitialized Use in WebML in Google Chrome on Mac prior to …6.5
- CVE-2026-11034Insufficient validation of untrusted input in Tab Group Sync…6.1
- CVE-2026-11035Inappropriate implementation in Custom Tabs in Google Chrome…7.3
- CVE-2026-110359Hyland Desktop Host for Windows before 25.1.1 is vulnerable …7.8
Are you affected by CVE-2026-110311?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST