Issue Attachment Manipulation in Gitea

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: Gitea Limited

Description

The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-06

Generated

2026-10-07

AI Q&A

2026-10-07

EPSS Evaluated

N/A

NVD

CVE-2026-105268

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows issue authors to edit or delete attachments that belong to comments on the same issue. The API routes for issue attachments incorrectly accepted attachments from comments, enabling authors to modify or remove files uploaded by other users in comments.

Impact Analysis

If you use Gitea for issue tracking, an attacker could exploit this to delete or rename attachments in your comments, potentially removing important files or misleading others by altering filenames. The content of attachments remains unchanged, but their availability or context could be disrupted.

Mitigation Strategies

Update Gitea to the latest version to address the issue with issue attachment handling. Review and restrict permissions for users who can edit or delete issue attachments to prevent unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-105268. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70