Gitea CVE-2026-105268

Requires an authenticated Gitea account with permission to open an issue, AND the presence of attachments posted by OTHER users on comments within an issue that the attacker authored - the flaw only grants control over comment attachments reachable through the attacker's own issue via the /api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id} endpoint, which failed to exclude comment-owned attachments. Exploitation is LIMITED to renaming or deleting those attachments; attachment file contents cannot be modified (C:N), and no privilege escalation or access beyond the attacker's existing repository scope is possible. The low-privilege authentication requirement (PR:L) and the integrity-only, data-destruction-scoped effect are the primary factors that keep realistic risk low despite the network-accessible, low-complexity API vector.

All available signals converge on this being a LOW real-world priority rather than a high-CVSS-but-overstated issue. The CVSS 3.1 base score is only 4.3 (Medium), and its vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) already reflects a limited, integrity-only impact requiring an authenticated actor. The EPSS score of 0.15% (3rd percentile) indicates very low predicted exploitation probability, and CISA's SSVC framework classifies Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial' - all three agreeing with the low CVSS. The issue is NOT on the CISA KEV list and there is no public exploit identified at time of analysis, so no signals conflict with the low-risk conclusion. The one nuance worth stating explicitly is that the input Tag labels this an 'Authentication Bypass,' which is inaccurate: CWE-639 and the CVSS PR:L value both show this is an AUTHORIZATION flaw abusable only by an already-authenticated user who authored the issue, not a pre-authentication bypass. The fix (PR #39501, issue_attachment.go) and affected range (Gitea ≤28.0.0, fixed in 28.1.0) are well corroborated across NVD, the Gitea GHSA advisory, and EUVD, so confidence in the vulnerability itself is high even though its practical severity is modest.

An authenticated Gitea user opens an issue in a repository they can access; other collaborators then reply with comments that include file attachments. Abusing the issue-attachment API endpoint, the issue author passes a comment's attachment_id and renames or deletes other users' comment attachments, even though those should not be under their control. No public exploit code exists, but the attack is trivial (AV:N/AC:L) for any user who can open an issue; it cannot alter attachment contents, only metadata/existence.