fix(security): prevent unauthorized access to draft release attachments (#13934)

The `GetReleaseAttachment` API endpoint (`GET /repos/{owner}/{repo}/releases/{id}/assets/{attachment_id}`) and the web attachment download route (`ServeAttachment`, `GET /attachments/{uuid}`) did not check whether the release is a draft. Users holding only repository **read** permission (including unauthenticated callers on public repositories) could enumerate release/attachment IDs and retrieve the metadata and the full contents of attachments belonging to draft releases that are otherwise hidden from them.

`GetRelease` and `ListReleaseAttachments` already return 404 for draft releases when the caller lacks write permission on the releases unit (added in the 2026-06-10 security patches), but these two endpoints were missed. This is the same class of issue fixed by Gitea in [CVE-2026-27660](https://nvd.nist.gov/vuln/detail/CVE-2026-27660) and [GHSA-q9pg-jj6x-j9p6](GHSA-q9pg-jj6x-j9p6).

Co-authored-by: trim21 <i@trim21.me>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13934
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>

Author: 2 people

release-notes/13934.md

@@ -0,0 +1 @@
+Users with only read permission on a repository (including unauthenticated callers on public repositories) could retrieve the metadata and the full contents of attachments belonging to draft releases, even though draft releases are hidden from them. The `GetReleaseAttachment` API endpoint and the web attachment download route (`ServeAttachment`) did not check whether the release is a draft, while `GetRelease` and `ListReleaseAttachments` already do. This is the same class of issue fixed upstream by Gitea in CVE-2026-27660 and GHSA-q9pg-jj6x-j9p6.

routers/api/v1/repo/release_attachment.go

@@ -23,21 +23,27 @@ import (
 	"forgejo.org/services/convert"
 )
 
-func checkReleaseMatchRepo(ctx *context.APIContext, releaseID int64) bool {
+func checkReleaseAccess(ctx *context.APIContext, releaseID int64) *repo_model.Release {
 	release, err := repo_model.GetReleaseByID(ctx, releaseID)
 	if err != nil {
 		if repo_model.IsErrReleaseNotExist(err) {
 			ctx.NotFound()
-			return false
+			return nil
 		}
 		ctx.Error(http.StatusInternalServerError, "GetReleaseByID", err)
-		return false
+		return nil
 	}
 	if release.RepoID != ctx.Repo().Repository.ID {
 		ctx.NotFound()
-		return false
+		return nil
 	}
-	return true
+	// Draft releases and their attachments must not be visible to users
+	// without write permission on the releases unit, mirroring GetRelease.
+	if release.IsDraft && !ctx.Repo().CanWrite(unit_model.TypeReleases) {
+		ctx.NotFound()
+		return nil
+	}
+	return release
 }
 
 // GetReleaseAttachment gets a single attachment of the release
@@ -77,7 +83,7 @@ func GetReleaseAttachment(ctx *context.APIContext) {
 	//     "$ref": "#/responses/notFound"
 
 	releaseID := ctx.ParamsInt64(":id")
-	if !checkReleaseMatchRepo(ctx, releaseID) {
+	if checkReleaseAccess(ctx, releaseID) == nil {
 		return
 	}
 
@@ -131,21 +137,8 @@ func ListReleaseAttachments(ctx *context.APIContext) {
 	//     "$ref": "#/responses/notFound"
 
 	releaseID := ctx.ParamsInt64(":id")
-	release, err := repo_model.GetReleaseByID(ctx, releaseID)
-	if err != nil {
-		if repo_model.IsErrReleaseNotExist(err) {
-			ctx.NotFound()
-			return
-		}
-		ctx.Error(http.StatusInternalServerError, "GetReleaseByID", err)
-		return
-	}
-	if release.RepoID != ctx.Repo().Repository.ID {
-		ctx.NotFound()
-		return
-	}
-	if release.IsDraft && !ctx.Repo().CanWrite(unit_model.TypeReleases) {
-		ctx.NotFound()
+	release := checkReleaseAccess(ctx, releaseID)
+	if release == nil {
 		return
 	}
 	if err := release.LoadAttributes(ctx); err != nil {
@@ -217,7 +210,7 @@ func CreateReleaseAttachment(ctx *context.APIContext) {
 
 	// Check if release exists an load release
 	releaseID := ctx.ParamsInt64(":id")
-	if !checkReleaseMatchRepo(ctx, releaseID) {
+	if checkReleaseAccess(ctx, releaseID) == nil {
 		return
 	}
 
@@ -362,7 +355,7 @@ func EditReleaseAttachment(ctx *context.APIContext) {
 
 	// Check if release exists an load release
 	releaseID := ctx.ParamsInt64(":id")
-	if !checkReleaseMatchRepo(ctx, releaseID) {
+	if checkReleaseAccess(ctx, releaseID) == nil {
 		return
 	}
 
@@ -443,7 +436,7 @@ func DeleteReleaseAttachment(ctx *context.APIContext) {
 
 	// Check if release exists an load release
 	releaseID := ctx.ParamsInt64(":id")
-	if !checkReleaseMatchRepo(ctx, releaseID) {
+	if checkReleaseAccess(ctx, releaseID) == nil {
 		return
 	}
 

routers/web/repo/attachment.go

@@ -10,6 +10,7 @@ import (
 	"forgejo.org/models/auth"
 	access_model "forgejo.org/models/perm/access"
 	repo_model "forgejo.org/models/repo"
+	"forgejo.org/models/unit"
 	"forgejo.org/modules/httpcache"
 	"forgejo.org/modules/log"
 	"forgejo.org/modules/setting"
@@ -153,6 +154,20 @@ func ServeAttachment(ctx *context.Context, uuid string) {
 			ctx.Error(http.StatusNotFound)
 			return
 		}
+
+		// Attachments of draft releases must not be accessible without write
+		// permission on the releases unit, mirroring the release API.
+		if attach.ReleaseID != 0 {
+			rel, err := repo_model.GetReleaseByID(ctx, attach.ReleaseID)
+			if err != nil {
+				ctx.ServerError("GetReleaseByID", err)
+				return
+			}
+			if rel.IsDraft && !perm.CanWrite(unit.TypeReleases) {
+				ctx.Error(http.StatusNotFound)
+				return
+			}
+		}
 	}
 
 	if attach.ExternalURL != "" {

tests/integration/api_releases_test.go

@@ -388,6 +388,52 @@ func TestAPIReleaseGetAssets(t *testing.T) {
 	})
 }
 
+func TestAPIReleaseDraftAttachmentUnauthorizedAccess(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
+	ownerSession := loginUser(t, owner.LowerName)
+	ownerToken := getTokenForLoggedInUser(t, ownerSession, auth_model.AccessTokenScopeWriteRepository)
+
+	rel := unittest.AssertExistsAndLoadBean(t, &repo_model.Release{
+		RepoID:  repo.ID,
+		TagName: "draft-release",
+	})
+	assert.True(t, rel.IsDraft)
+
+	// sanity checks: the draft release itself and its attachment list are not
+	// visible to anonymous users (only the repository read permission is held)
+	req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/%s/releases/%d", owner.Name, repo.Name, rel.ID))
+	MakeRequest(t, req, http.StatusNotFound)
+	req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/%s/releases/%d/assets", owner.Name, repo.Name, rel.ID))
+	MakeRequest(t, req, http.StatusNotFound)
+
+	// the owner uploads an attachment to the draft release
+	filename := "draft-secret.png"
+	buff := generateImg()
+	body := &bytes.Buffer{}
+	contentType := tests.WriteImageBody(t, buff, filename, body)
+
+	assetURL := fmt.Sprintf("/api/v1/repos/%s/%s/releases/%d/assets", owner.Name, repo.Name, rel.ID)
+	req = NewRequestWithBody(t, http.MethodPost, assetURL, bytes.NewReader(body.Bytes())).
+		AddTokenAuth(ownerToken).
+		SetHeader("Content-Type", contentType)
+	resp := MakeRequest(t, req, http.StatusCreated)
+	var attachment *api.Attachment
+	DecodeJSON(t, resp, &attachment)
+	require.NotNil(t, attachment)
+
+	// attachments of a draft release must not be accessible without write
+	// permission on the releases unit: the attachment metadata ...
+	req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/%s/releases/%d/assets/%d", owner.Name, repo.Name, rel.ID, attachment.ID))
+	MakeRequest(t, req, http.StatusNotFound)
+
+	// ... nor the attachment content
+	req = NewRequest(t, "GET", "/attachments/"+attachment.UUID)
+	MakeRequest(t, req, http.StatusNotFound)
+}
+
 func TestAPIReleaseDeleteByTagName(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()