Medium · published October 7, 2026
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
| Product | Versions | Fixed in |
|---|---|---|
| gitea/gitea | < 28.1.0 | 28.1.0 |