CVE-2026-110311
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 18, 2026
Vendor
unknown
Description
Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.