CVE-2026-107686

Received Received - Intake

Reaction Manipulation in Gitea Issue Comments

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-107686

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves Gitea's web handlers for adding and removing reactions on issues and comments. These handlers did not enforce the locked status of issues for users without write access, unlike the API. As a result, a signed-in user with read access could bypass the lock restriction and modify reactions on locked issues or comments, though they could not change the actual content.

Impact Analysis

If you use Gitea and rely on issue locking to restrict interactions, this vulnerability could allow unauthorized users to add or remove reactions on locked issues or comments. This may disrupt issue tracking or comment integrity, though it does not permit content modification or unauthorized access.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a bypass of interaction restrictions in Gitea by allowing reaction changes on locked issues, which is unrelated to data protection or privacy requirements.

Mitigation Strategies

Update Gitea to the latest version that patches this issue. Review issue and comment reaction permissions for users without write access. Ensure locked issues are properly restricted from modifications.

Hi! I’m here to help you understand CVE-2026-107686. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70