CVE-2026-105268 json
Gitea issue attachment API allows changing comment attachments
published last mo. modified last mo. also BIT-gitea-2026-105268 , EUVD-2026-94064 , GHSA-96qg-qxxj-r8xq
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 9%
- public exploits
- 0
- none known
Summary
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
Patch / fix
- bitnami gitea 28.1.0
- gitea gitea 28.1.0
- github.com/go-gitea/gitea#39501 pull request
- github.com/go-gitea/gitea#39507 pull request
- github.com/go-gitea/gitea/releases/tag/v28.1.0 release
Is CVE-2026-105268 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last mo.
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | gitea | <28.1.0 |
28.1.0 |
Affected products
- Gitea Gitea
Classification
References
-
github.com
/go-gitea/gitea/pull/39501
patch
-
github.com
/go-gitea/gitea/pull/39507
patch
-
github.com
/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xq
vendor-advisory, advisory
-
blog.gitea.com
/release-of-28.1.0/
release-notes, article
-
github.com
/go-gitea/gitea/releases/tag/v28.1.0
release-notes, article
-
nvd.nist.gov
/vuln/detail/CVE-2026-105268
web
Sources
- CVE List CVE-2026-105268
- NVD CVE-2026-105268
- OSV BIT-gitea-2026-105268
- Maintainer advisory GHSA-96qg-qxxj-r8xq
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of go-gitea/gitea published their own advisory on GitHub. Reviewed sources take precedence over it.