CVE-2026-105268
Gitea issue attachment API allows changing comment attachments
Published Oct 14, 2026 · updated Oct 14, 2026
The Gitea API routes for issue attachments ( ) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · GitHub Advisory Database
Detected
The Gitea API routes for issue attachments ( ) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
Oct 14, 2026 · GitHub Advisory Database
Fix available
gitea fixed in 28.1.0
Oct 14, 2026 · GitHub Advisory Database
Fix available
gitea fixed in 28.1.0
Oct 14, 2026 · GitHub Advisory Database
Updated
The Gitea API routes for issue attachments ( ) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
Affected
- Bitnami gitea0 → 28.1.0
Sources
- CVE.orgVulnerability recordCVE-2026-105268
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-96qg-qxxj-r8xq
GitHub Advisory Database record mirrored by OSV.
github.com - OSV.devPackage advisoryBIT-gitea-2026-105268
Gitea issue attachment API allows changing comment attachments
osv.dev