Skip to content
Heist/ feed
Back to feed
Medium

Gitea issue attachment API allows changing comment attachments

Type: advisorySources: OSV

The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-105268
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 20:44 UTC · Revision 1

Source evidence

Gitea issue attachment API allows changing comment attachments

core-osv · Original source

Published 6 Oct 2026, 21:35 UTC

The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.

osv:CVE-2026-105268
Complete source record
{
  "id": "817bb9c100bc1c28424a43af749afa3b5d457f9f58ee95d4513348f4aad035bf",
  "url": "https://osv.dev/vulnerability/CVE-2026-105268",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Gitea issue attachment API allows changing comment attachments",
    "summary": "The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.",
    "evidence": "osv:CVE-2026-105268",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-105268",
      "aliases": [
        "BIT-gitea-2026-105268",
        "CVE-2026-105268",
        "GHSA-96qg-qxxj-r8xq"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/go-gitea/gitea",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4ebd5e319b6a9e629bfd7a04292a6fe85b08dee9"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "28.1.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "4ebd5e319b6a9e629bfd7a04292a6fe85b08dee9"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v28.1.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v28.0.0",
            "v29.0.0-dev",
            "v1.28.0-dev",
            "v1.27.0-dev",
            "v1.26.0-dev",
            "v1.25.0-dev",
            "v1.24.0-dev",
            "v1.22.0-rc1",
            "v1.23.0-dev",
            "v1.22.0-rc0",
            "v1.21.0-rc0",
            "v1.22.0-dev",
            "v1.20.0-rc0",
            "v1.21.0-dev",
            "v1.20.0-dev",
            "v1.19.0-rc0",
            "v1.18.0-rc0",
            "v1.19.0-dev",
            "v1.18.0-dev",
            "v1.17.0-dev",
            "v1.16.0-rc1",
            "v1.15.0-rc1",
            "v1.16.0-dev",
            "v1.15.0-dev",
            "v1.14.0-dev",
            "v1.13.0-dev",
            "v1.12.0-dev",
            "v1.10.5",
            "v1.11.0-rc1",
            "v1.10.0-rc1",
            "v1.11.0-dev",
            "v1.9.0-rc1",
            "v1.10.0-dev",
            "v1.9.0-dev",
            "v1.7.0-dev",
            "v1.6.0-rc1",
            "v1.6.0-dev",
            "v1.5.0-rc1",
            "v1.5.0-dev",
            "v1.1.0",
            "v1.0.0",
            "v0.9.99"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105268.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.442369713Z",
      "provider": "osv",
      "references": [
        "https://blog.gitea.com/release-of-28.1.0/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105268.json",
        "https://github.com/go-gitea/gitea/releases/tag/v28.1.0",
        "https://github.com/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xq",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-105268",
        "https://github.com/go-gitea/gitea/pull/39501",
        "https://github.com/go-gitea/gitea/pull/39507"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-639",
          "CWE-863"
        ],
        "cna_assigner": "Gitea",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105268.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-105268",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 520351,
  "published_at": "2026-10-06T21:35:40.926+00:00"
}