BIT-gitea-2026-105268

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/gitea/BIT-gitea-2026-105268.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-gitea-2026-105268
Aliases
Published
2026-10-14T08:42:44Z
Modified
2026-10-14T11:11:13Z
Summary
Gitea issue attachment API allows changing comment attachments
Details

The Gitea API routes for issue attachments (/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*"
    ],
    "severity":  "Medium"
}
References

Affected packages

Bitnami / gitea

Package

Name
gitea
Purl
pkg:bitnami/gitea

Severity

  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
28.1.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/gitea/BIT-gitea-2026-105268.json"