CVE-2026-105268
mediumThe Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comm…
Vendor / product: Gitea — gitea
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
CVSS
4.3
4.3 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Severity source: NVD CVSS v3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
Timeline (UTC)
Published: 2026-10-06 22:17
Modified: 2026-10-13 14:38
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
gitea / gitea <28.1.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/go-gitea/gitea/pull/39501
Patch / mitigation: https://github.com/go-gitea/gitea/pull/39507
References
- https://blog.gitea.com/release-of-28.1.0/ 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/pull/39501 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/pull/39507 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/releases/tag/v28.1.0 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xq 88ee5874-cf24-4952-aea0-31affedb7ff2
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗