CVE-2026-105268

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105268

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows issue authors to edit or delete attachments that belong to comments on the same issue. The API routes for issue attachments incorrectly accepted attachments from comments, enabling authors to modify or remove files uploaded by other users in comments.

Detection Guidance

This vulnerability involves unauthorized modification or deletion of attachments in Gitea issue comments. To detect it, monitor Gitea logs for unexpected attachment changes or deletions, especially by users who did not originally upload the files. Check API logs for requests to /api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id} with suspicious user agents or IP addresses.

Impact Analysis

If you use Gitea for issue tracking, an attacker could exploit this to delete or rename attachments in your comments, potentially removing important files or misleading others by altering filenames. The content of attachments remains unchanged, but their availability or context could be disrupted.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it involves unauthorized modification of file attachments in a version control system rather than exposure or mishandling of personal or health data.

Mitigation Strategies

Update Gitea to the latest version to address the issue with issue attachment handling. Review and restrict permissions for users who can edit or delete issue attachments to prevent unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-105268. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70