Incorrect authorization in Gitea - CVE-2026-105267
Published: October 19, 2026
Vulnerability identifier: #VU156109
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105267
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to permanently delete published releases and their attachments without release-write permission.
The vulnerability exists due to incorrect authorization in the Gitea POST /{owner}/{repo}/tags/delete endpoint when processing deletion requests without distinguishing bare tags from full releases. A remote user can submit a deletion request targeting a release with only Code:Write permission to delete the release record and its attachments from the database and blob storage.
Deletion is restricted to releases in the targeted repository.
Affected software
Gitea
How to mitigate CVE-2026-105267
Install security update from vendor's website.
Gitea - update to 28.1.0