CVE-2026-105267

Katalog CVE

CVSS 8.1 · High EPSS 0,38%

Kerentanan Incorrect Permission Assignment for Critical Resource pada gitea. Skor CVSS 3.1 8.1 (High) menurut CISA ADP.

Deskripsi (NVD)

The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-gitea/gitea/security/advisories/GHSA-vvqw-mjq8-x248 advisory vendor
• https://github.com/go-gitea/gitea/pull/39501 patch
• https://github.com/go-gitea/gitea/pull/39507 patch
• https://blog.gitea.com/release-of-28.1.0/ release notes
• https://github.com/go-gitea/gitea/releases/tag/v28.1.0 release notes