Live › vulnerability › CVE-2026-110494
Go to dashboardAdding an attachment to a release did not check whether the attachment was already linked to an issue or comment. A user with write access to a repository's releases who knew an attachment's UUID could link it to a release, read its file name, size and download count, and rename or delete it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it.
This page as .md · .json · in your agent: get_signal("CVE-2026-110494")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.