CVE-2026-105268

Description

The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.

Traduire en français

Produits concernés

• Gitea
• Gitea gitea

Scores CVSS

Faiblesses (CWE)

• CWE-639
• CWE-863

Références

• https://blog.gitea.com/release-of-28.1.0/ Release Notes
• https://github.com/go-gitea/gitea/pull/39501 Patch
• https://github.com/go-gitea/gitea/pull/39507 Patch
• https://github.com/go-gitea/gitea/releases/tag/v28.1.0 Release Notes
• https://github.com/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xq Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories