Improper Authorization in Gitea - CVE-2026-107686
Published: October 19, 2026
Vulnerability identifier: #VU156115
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-107686
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass thread locks and add or remove emoji reactions on locked issues, pull requests, and their comments in Gitea.
The vulnerability exists due to missing authorization checks in the ChangeIssueReaction and ChangeCommentReaction web handlers when processing reaction changes on locked threads. A remote user can submit requests to these web routes for a visible locked thread to add or remove reactions despite lacking collaborator permissions.
Affected software
Gitea
How to mitigate CVE-2026-107686
Install security update from vendor's website.
Gitea - update to 28.2.0