CyberRota Analysis
AI-GeneratedThe Gitea API is vulnerable as it allows users to manipulate attachments associated with comments on issues, enabling them to rename or delete attachments uploaded by other users. This could lead to unauthorized alteration of shared resources, potentially disrupting collaboration and information integrity within projects. Organizations using Gitea for issue tracking and collaboration should prioritize addressing this vulnerability to safeguard their data and maintain proper access controls.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
Related CVEs
Other vulnerabilities affecting the same vendor(s)