Affected: Gitea Open Source Git Server

Cross-repository issue/comment attachment re-linking can expose private attachment content

Affected: Go: code.gitea.io/gitea

## Summary

Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or comment, causing later attachment access checks to use the attacker's repository authorization context.

## Affected

- Component: web issue/comment attachment handling. - Confirmed version: `main` commit `a39b2775edcb3ba53def96794491b91335117d81` (`v1.27.0-dev-352-ga39b2775ed`). - Fixed in: not fixed at the time of validation. - Other versions: not exhaustively tested. The affected code path appears structurally similar to versions that contain the current issue/comment attachment update logic.

## Description / Root Cause

`files[]` values from issue/comment edit flows are passed to `updateAttachments` in `routers/web/repo/issue.go:589-629`. That helper calls:

- `models/issues/issue_update.go:267-278` (`UpdateIssueAttachments`) - `models/issues/comment.go:623-642` (`UpdateCommentAttachments`)

Both functions load attachments by UUID and update the attachment linkage, but neither validates that the attachment row's `RepoID` matches the repository of the target issue/comment. They also do not reject attachments already linked to a different issue/comment.

Attachment reads then use the linked issue/release repository to decide access:

- `services/repository/repository.go:185-2…