Listen to this Post
Gitea generates a unique identifier for each file attachment uploaded to issues, pull requests, or comments. This identifier is stored in the database and linked to the specific repository where the upload originated. The vulnerability exists within the attachment deletion API endpoint (/api/v1/repos/{owner}/{repo}/issues/attachments/{attachment_id}). When a DELETE request is processed, the application correctly verifies the user’s authentication and their write permissions to the repository specified in the request path ({owner}/{repo}). However, it fails to perform a secondary, crucial authorization check: it does not validate that the target `{attachment_id}` actually belongs to the repository context provided in the URL. The attachment ID itself is not cryptographically tied to its source repository. Therefore, a user who previously obtained a valid attachment ID from Repository A can subsequently issue a DELETE request for that same ID but target it against Repository B, where they currently have write access. The system authenticates the user for Repository B and, finding the attachment ID in the global database table, proceeds to delete the file without confirming repository ownership, leading to unauthorized data destruction.
Platform: Gitea
Version: Not Specified
Vulnerability: Improper Access Control
Severity: Low
Date: 2026-01-22
Prediction: 2026-01-30
What Undercode Say:
Enumerate potential attachment IDs (numeric)
for id in {1000..2000}; do
curl -X DELETE -H "Authorization: token $USER_TOKEN" \
"https://target-gitea/api/v1/repos/victim/repo-a/issues/attachments/$id"
done
Check server response for successful deletion (204) vs. error (404/500)
How Exploit:
- User uploads file to Repository A, obtains attachment ID (e.g., 1234).
- User loses write/admin access to Repository A (e.g., removed from team).
- User, having write access to Repository B, sends DELETE request to Repository B’s endpoint with ID 1234.
- Gitea deletes the original file from Repository A’s storage.
Protection from this CVE:
Implement server-side verification. Before deletion, query must check `attachment.repo_id` matches the `repository.id` from the request URL path. Add middleware or service-layer authorization logic.
Impact:
Unauthorized deletion of attachments in private repositories. Data loss integrity compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
