CVE-2026-105267 Gitea CVE debrief

Who should care

Gitea instance administrators and collaborators with Code write access should assess exposure and apply patches promptly. Defenders should prioritize verifying exposure and applying patches for Gitea instances with untrusted collaborators to mitigate potential impacts. Gitea instance administrators should review compensating controls and monitor for suspicious activity.

Why it matters

Defenders should care about this vulnerability as it allows collaborators with Code write access to delete published releases without Releases write access, potentially leading to data loss and increased risk for Gitea instances with untrusted collaborators.

• Unintended release deletion by collaborators
• Potential data loss due to release attachment deletion
• Increased risk for Gitea instances with untrusted collaborators
• Verification priority for Gitea instance administrators

Technical summary

The Gitea web route for deleting tags requires only write access to the Code unit but did not check if the target was a plain tag. This flaw allows collaborators with Code write access to delete published releases without Releases write access, potentially leading to data loss. The vulnerability highlights the importance of proper access controls and validation in Gitea's tag deletion process. Defenders should prioritize verifying exposure and applying patches for Gitea instances with untrusted collaborators to mitigate potential impacts.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Gitea instances with untrusted collaborators.

Recommended defensive actions

• Verify Gitea instance exposure and apply patches
• Restrict Code write access to trusted collaborators
• Monitor for suspicious release deletion activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates through normal change control

Evidence notes

The CVE record and source item provide details on the vulnerability and affected versions. The Gitea web route for deleting tags requires only write access to the Code unit but did not check if the target was a plain tag, allowing collaborators with Code write access to delete published releases without Releases write access. There are no known exploits, but defenders should verify exposure and apply patches. Official CVE Program record and NIST NVD detail page provide additional information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.