GHSA-6c6r-5xr4-cr5m: Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or comment, causing later attachment access checks to use the attacker's repository authorization context. Affected - Component: web issue/comment attachment handling. - Confirmed version: main commit a39b2775edcb3ba53def96794491b91335117d81 (v1.27.0-dev-352-ga39b2775ed). - Fixed in: not fixed at the time of validation. - Other versions: not exhaustively tested. The affected code path appears structurally similar to versions that contain the current issue/comment attachment update logic. Description / Root Cause files[] values from issue/comment edit flows are passed to updateAttachments in routers/web/repo/issue.go:589-629. That helper calls: - models/issues/issue_update.go:267-278 (UpdateIssueAttachments) - models/issues/comment.go:623-642 (UpdateCommentAttachments) Both functions load attachments by UUID and update the attachment linkage, but neither validates that the attachment row's RepoID matches the repository of the target issue/comment. They also do not reject attachments already linked to a different issue/comment. Attachment reads then use the linked issue/release repository to decide access: - services/repository/repository.go:185-207 returns the repository ID from IssueID or ReleaseID. - routers/web/repo/attachment.go:153-184 checks read permission on that linked repository. - routers/web/repo/attachment.go:216-224 opens and serves the file from the attachment's storage path after the linked-repository permission check succeeds. For the global /attachments/{uuid} route in routers/web/web.go:872-876, there is no current repository context, so the early attach.RepoID mismatch check in ServeAttachment does not protect against this re-linking case. A patch