SB2026101920 - Multiple vulnerabilities in Gitea

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101920

SB2026101920 - Multiple vulnerabilities in Gitea

Published: October 19, 2026

Security Bulletin ID SB2026101920
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Improper Authorization (CVE-ID: CVE-2026-107686)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass thread locks and add or remove emoji reactions on locked issues, pull requests, and their comments in Gitea.

The vulnerability exists due to missing authorization checks in the ChangeIssueReaction and ChangeCommentReaction web handlers when processing reaction changes on locked threads. A remote user can submit requests to these web routes for a visible locked thread to add or remove reactions despite lacking collaborator permissions.


2) Cross-site request forgery (CVE-ID: CVE-2026-107618)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to overwrite or clear repository topics without authorization.

The vulnerability exists due to missing cross-site request forgery protection in the Gitea POST /{owner}/{repo}/topics route when handling cross-site requests, because the route omits the sign-in middleware that performs cross-origin checks. A remote attacker can lure a logged-in repository administrator to a malicious or compromised website that submits a cross-site POST with the administrator's session cookie to overwrite or clear that repository's topics.


3) Information disclosure (CVE-ID: CVE-2026-110311)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose attachment metadata from private repositories and abandoned uploads across a Gitea instance.

The vulnerability exists due to premature attachment loading and missing repository filtering in Gitea's draft release creation process when handling API requests to create draft releases. A remote user can create a draft release in a repository they control to retrieve instance-wide attachment names, UUIDs, sizes, timestamps, and download counts through the response's assets array, because the unsaved release has an ID of 0 that matches attachments without a release link.


4) Incorrect authorization (CVE-ID: CVE-2026-97204)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete another organisation's labels without authorization, removing their associations with issues in that organisation.

The vulnerability exists due to incorrect authorization in Gitea's DeleteLabel function when comparing a caller-supplied repository identifier against a label's organisation identifier without distinguishing their namespaces. A remote user can use issues-write permission on a repository whose identifier matches an organisation's identifier to submit a repository-scoped deletion request targeting that organisation's label and delete it without organisation ownership.


5) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-110494)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose issue attachment metadata and rename or permanently delete issue attachments without the corresponding issue access.

The vulnerability exists due to a missing authorization check on IssueID in Gitea's AddReleaseAttachments function in models/repo/release.go when linking attachments to releases. A remote user can use release write permission and a known attachment UUID to link an issue attachment from the same repository to a release they control, exposing its filename, UUID, size, and download count and enabling its renaming or permanent deletion.

File content downloads remain subject to issue-level read permission because the download handler checks IssueID before ReleaseID.


6) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-105964)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service affecting all Gitea services by exhausting server memory.

The vulnerability exists due to allocation of resources without size limits in the parseProtobufBody function of Gitea's Actions Artifact V4 API when reading HTTP request bodies into memory using io.ReadAll. A remote user can use a valid Actions runner token to send an oversized HTTP POST request to any of the five Artifact Service endpoints, exhausting heap memory and causing fatal termination of the Gitea process.

Exploitation requires push access to a repository with Actions enabled and a connected runner.


Remediation

Install update from vendor's website.

References