The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.
References
| Link | Resource |
|---|---|
| https://blog.gitea.com/release-of-28.1.0/ | Release Notes |
| https://github.com/go-gitea/gitea/pull/39501 | Patch |
| https://github.com/go-gitea/gitea/pull/39507 | Patch |
| https://github.com/go-gitea/gitea/releases/tag/v28.1.0 | Release Notes |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xq | Vendor Advisory |
Configurations
History
13 Oct 2026, 14:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blog.gitea.com/release-of-28.1.0/ - Release Notes | |
| References | () https://github.com/go-gitea/gitea/pull/39501 - Patch | |
| References | () https://github.com/go-gitea/gitea/pull/39507 - Patch | |
| References | () https://github.com/go-gitea/gitea/releases/tag/v28.1.0 - Release Notes | |
| References | () https://github.com/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xq - Vendor Advisory | |
| First Time |
Gitea gitea
Gitea |
|
| CPE | cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:* |
07 Oct 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
06 Oct 2026, 22:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 22:17
Updated : 2026-10-13 14:38
NVD link : CVE-2026-105268
Mitre link : CVE-2026-105268
CVE.ORG link : CVE-2026-105268
JSON object : View
Products Affected
gitea
- gitea