CVE-2026-107686 Gitea CVE debrief

Who should care

Gitea administrators, users with write access to issues, and security teams monitoring for potential interaction bypass vulnerabilities should assess exposure and apply patches. Additionally, Gitea users who have locked issues or comments and want to prevent unauthorized users from manipulating reactions should also take action. Security teams should review Gitea instance configurations and user permissions to ensure that access controls are in place. G

Why it matters

CVE-2026-107686 allows signed-in users to add or remove reactions on locked Gitea issues and comments, bypassing interaction restrictions. Defenders should verify exposure, apply patches, and monitor for suspicious activity.

• Potential for unauthorized users to manipulate reactions on locked issues, affecting issue visibility and user trust.
• Bypassing of interaction restrictions could lead to information disclosure or manipulation.
• Requires verification of Gitea instance version and exposure to vulnerable functionality.
• Patching or updating Gitea instances is necessary to prevent exploitation.

Technical summary

The Gitea web handlers for adding and removing reactions on issues and comments did not properly enforce interaction restrictions for locked issues, allowing signed-in users to bypass these restrictions. This vulnerability affects Gitea versions up to 28.1.0. The issue is caused by a lack of proper access control in the Gitea web handlers, which allows users to manipulate reactions on locked issues and comments. This could lead to unauthorized users affecting issue visibility and user trust. Defenders should assess exposure and apply patches to prevent exploitation.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Gitea instances, especially those allowing user interactions.

Recommended defensive actions

• Verify Gitea instance version and exposure to vulnerable functionality
• Apply patches or updates to Gitea instances
• Monitor for suspicious reaction activity on locked issues and comments
• Review and adjust access controls for Gitea users and issues
• Perform a thorough review of Gitea instance configurations and user permissions
• Ensure that Gitea instances are updated to the latest version
• Implement additional monitoring and logging to detect potential exploitation attempts

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, CVSS scores and detailed exploitation information are not provided. The vulnerability allows signed-in users to bypass interaction restrictions on locked issues and comments in Gitea. The source item and CVE record do not provide explicit evidence of exploitation or detailed technical information. Defenders should verify Gitea instance versions, review access controls, and monitor for suspicious activity. The lack of CVSS 3

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.