CVE-2026-105267

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105267", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-10-04T22:02:04.888Z", "datePublished": "2026-10-06T21:35:35.508Z", "dateUpdated": "2026-10-07T20:02:51.066Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-06T21:35:35.508Z"}, "title": "Gitea tag delete route deletes releases without release permission", "descriptions": [{"lang": "en", "value": "The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "28.0.0", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-vvqw-mjq8-x248", "name": "GitHub Security Advisory GHSA-vvqw-mjq8-x248", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39501", "name": "Fix: go-gitea/gitea pull request #39501", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39507", "name": "Fix backport to release/v28: go-gitea/gitea pull request #39507", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.1.0/", "name": "Gitea 28.1.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.1.0", "name": "go-gitea/gitea v28.1.0 release", "tags": ["release-notes"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource"}, {"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "credits": [{"lang": "en", "value": "https://github.com/N0K0", "type": "reporter"}, {"lang": "en", "value": "https://github.com/silverwind", "type": "remediation developer"}, {"lang": "en", "value": "https://github.com/bircni", "type": "remediation developer"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T20:02:28.853973Z", "id": "CVE-2026-105267", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T20:02:51.066Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-105267", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T20:02:28.853973Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T20:02:47.886Z"}}], "cna": {"title": "Gitea tag delete route deletes releases without release permission", "credits": [{"lang": "en", "type": "reporter", "value": "https://github.com/N0K0"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/silverwind"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/bircni"}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "28.0.0"}], "packageName": "gitea.dev", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-vvqw-mjq8-x248", "name": "GitHub Security Advisory GHSA-vvqw-mjq8-x248", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39501", "name": "Fix: go-gitea/gitea pull request #39501", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39507", "name": "Fix backport to release/v28: go-gitea/gitea pull request #39507", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.1.0/", "name": "Gitea 28.1.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.1.0", "name": "go-gitea/gitea v28.1.0 release", "tags": ["release-notes"]}], "descriptions": [{"lang": "en", "value": "The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource"}, {"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-06T21:35:35.508Z"}}}, "cveMetadata": {"cveId": "CVE-2026-105267", "state": "PUBLISHED", "dateUpdated": "2026-10-07T20:02:51.066Z", "dateReserved": "2026-10-04T22:02:04.888Z", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "datePublished": "2026-10-06T21:35:35.508Z", "assignerShortName": "Gitea"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "gitea.dev", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThanOrEqual": "28.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*", "matchCriteriaId": "A392C59B-D9D1-41C2-BBEC-C0E388C35439", "versionEndExcluding": "28.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion."}], "id": "CVE-2026-105267", "lastModified": "2026-10-13T14:38:48.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105267", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T20:02:28.853973Z", "version": "2.0.3"}}]}, "published": "2026-10-06T22:17:02.253", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"], "url": "https://blog.gitea.com/release-of-28.1.0/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Patch"], "url": "https://github.com/go-gitea/gitea/pull/39501"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Patch"], "url": "https://github.com/go-gitea/gitea/pull/39507"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"], "url": "https://github.com/go-gitea/gitea/releases/tag/v28.1.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Vendor Advisory"], "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-vvqw-mjq8-x248"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}, {"lang": "en", "value": "CWE-863"}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary"}]}

{"bugzilla": {"description": "code.gitea.io/gitea: Gitea: Unauthorized release deletion via tag deletion endpoint", "id": "2547233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547233"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-267", "details": ["The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion.", "A flaw was found in Gitea. The web endpoint used for deleting repository tags shares request handling logic with release deletion without verifying if the target is an ordinary tag. An authenticated collaborator with code write permissions can exploit this flaw to bypass release access controls and permanently delete published repository releases and their attachments."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-105267", "public_date": "2026-10-06T21:35:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105267\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105267\nhttps://blog.gitea.com/release-of-28.1.0/\nhttps://github.com/go-gitea/gitea/pull/39501\nhttps://github.com/go-gitea/gitea/pull/39507\nhttps://github.com/go-gitea/gitea/releases/tag/v28.1.0\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-vvqw-mjq8-x248"], "statement": "A moderate-impact authorization flaw was found in Gitea, which is bundled in the Pipelines as Code controller and watcher container images shipped in the Konflux (konflux-pipeline-1) update stream. The Gitea web route for deleting repository tags (POST /{owner}/{repo}/tags/delete) shares its request-handling logic with release deletion without verifying that the target is a plain tag. An authenticated collaborator who has write access to a repository's Code unit but not to its Releases unit could therefore bypass release access controls and permanently delete published releases of that repository, including their attachments. Confidentiality is not affected. Red Hat Product Security rates this flaw Moderate severity (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L); this is lower than the external CISA score of 8.1 because exploitation requires an authenticated collaborator with Code write access and the resulting damage is limited to deletion of repository releases and their attachments rather than system-wide integrity or availability loss. Gitea protected tag rules covering a release tag still block its deletion, but releases whose tags are not covered by a protected tag rule remain exposed. Because the impact is Moderate and the CVSS score is below 7.0, the fix for the affected Konflux components is deferred in line with Red Hat's policy of not filing trackers for Moderate-severity flaws without a high CVSS score; the residual risk is that a collaborator with Code write access could irreversibly delete published releases and their attachments on deployments that expose the vulnerable endpoint.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,28.0.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Gitea", "source": "cna", "vendor": "Gitea"}, "product": "gitea", "vendor": "gitea"}], "created": "2026-10-06T23:15:06.952964+00:00", "updated": "2026-10-17T08:30:05.496387+00:00", "vendors": ["gitea", "gitea$PRODUCT$gitea"], "weaknesses": ["CWE-267", "CWE-732", "CWE-863"]}