GHSA-q9pg-jj6x-j9p6: Gitea: draft release attachment disclosure via missing web authorization

Summary Gitea's draft-release access control is enforced only on the API release endpoints (/api/v1/repos/{owner}/{repo}/releases/{id} and its /assets/... sub-routes) but not on the web-level UUID-based attachment endpoints (/attachments/{uuid}, /{owner}/{repo}/attachments/{uuid}, /{owner}/{repo}/releases/attachments/{uuid}). Anyone (including unauthenticated callers) who has, learns, or otherwise obtains the UUID of an attachment belonging to a draft release can download its full contents, despite the draft release itself being correctly hidden from listings and direct-by-ID API lookups. The browser_download_url field returned by the API (visible to anyone with write access to the repo) embeds the UUID. Forwarding this URL by email, log scrape, browser history, screenshot, or any side channel grants any recipient unauthenticated access to the attachment, indefinitely. This is the identical insider-leak threat model that Gitea fixed on the API surface in PR #36659 (CVE-2026-27660, Feb 2026) by adding canAccessReleaseDraft checks. The web mirror was missed. Details Root cause: the web-side handler ServeAttachment (routers/web/repo/attachment.go:122-203) checks only repo-level unit-read permission, never the IsDraft flag of the linked release: // routers/web/repo/attachment.go:122-203, current implementation func ServeAttachment(ctx *context.Context, uuid string) { attach, err := repo_model.GetAttachmentByUUID(ctx, uuid) if err != nil { ... } // cross-repo guard (only fires when accessed via repo-scoped URL) if attach.CreatedUnix > repo_model.LegacyAttachmentMissingRepoIDCutoff && ctx.Repo.Repository != nil && ctx.Repo.Repository.ID != attach.RepoID { ctx.HTTPError(http.StatusNotFound) return } unitType, repoID, err := repo_service.GetAttachmentLinkedTypeAndRepoID(ctx, attach) if unitType == unit.TypeInvalid { if !(ctx.IsSigned && attach.UploaderID == ctx.Doer.ID) { ctx.HTTPError(http.StatusNotFound) return } } else { var perm access_model.Permission // ... res