CVE-2026-105267

Gitea: incorrect authorisation

Risk score: 55/100
CVSS: 8.1 v3.1
Exploit chance (30 days): 0.4%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: The Gitea web route for deleting tags (POST /{owner}/{repo}/tags/delete) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete publishe…
Affected: Gitea
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…

The flaws

CVE-2026-105267: Incorrect authorisation (CVSS 8.1 · EPSS 0%)
CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Gitea

Where it stands

Exploited in the wild
On CISA's exploited list since 25 Aug
US federal deadline 28 Aug

How it unfolded

25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
28 Aug, Deadline (official): US federal agencies must have patched

Connects to

Same weakness: CWE-732 (CWE-732). 37 other warnings in 30 days
Same product: Earlier Gitea warnings. 25 in the last 90 days

Why it is Yellow

CVSS 8.1 high

References

Original description

The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion.

Last activity 6 Oct 2026. Patch Forecast updates every hour.