CVE-2026-105268

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The API endpoint /api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment id} incorrectly allows attachments belonging to issue comments to be processed as issue attachments. This allows the author of an issue to rename or delete attachments uploaded by other users within the comments of that issue, although the actual content of the attachments remains immutable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.