Gitea issue attachment API allows changing comment attachments
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-105268US | —OT elevated | — | ||
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Be… | ||||
02
references
External citations — patches, advisories, analysis.
- https://blog.gitea.com/release-of-28.1.0/ARTICLE
- https://github.com/go-gitea/gitea/pull/39501FIX
- https://github.com/go-gitea/gitea/pull/39507FIX
- https://github.com/go-gitea/gitea/releases/tag/v28.1.0ARTICLE
- https://github.com/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xqADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-105268WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan