CVE-2026-105268
Gitea issue attachment API allows changing comment attachments
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
| CWE | CWE-639 CWE-863 |
| Vendor | gitea |
| Product | gitea |
| Published | Oct 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for gitea gitea
Be the first to know when new unknown vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Gitea / Gitea
0 ≤ 28.0.0
References
github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xq github.com: https://github.com/go-gitea/gitea/pull/39501 github.com: https://github.com/go-gitea/gitea/pull/39507 blog.gitea.com: https://blog.gitea.com/release-of-28.1.0/ github.com: https://github.com/go-gitea/gitea/releases/tag/v28.1.0
Credits
🔍 https://github.com/N0K0 https://github.com/silverwind https://github.com/bircni