CVE-2026-105267

A moderate-impact authorization flaw was found in Gitea, which is bundled in the Pipelines as Code controller and watcher container images shipped in the Konflux (konflux-pipeline-1) update stream. The Gitea web route for deleting repository tags (POST /{owner}/{repo}/tags/delete) shares its request-handling logic with release deletion without verifying that the target is a plain tag. An authenticated collaborator who has write access to a repository's Code unit but not to its Releases unit could therefore bypass release access controls and permanently delete published releases of that repository, including their attachments. Confidentiality is not affected. Red Hat Product Security rates this flaw Moderate severity (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L); this is lower than the external CISA score of 8.1 because exploitation requires an authenticated collaborator with Code write access and the resulting damage is limited to deletion of repository releases and their attachments rather than system-wide integrity or availability loss. Gitea protected tag rules covering a release tag still block its deletion, but releases whose tags are not covered by a protected tag rule remain exposed. Because the impact is Moderate and the CVSS score is below 7.0, the fix for the affected Konflux components is deferred in line with Red Hat's policy of not filing trackers for Moderate-severity flaws without a high CVSS score; the residual risk is that a collaborator with Code write access could irreversibly delete published releases and their attachments on deployments that expose the vulnerable endpoint.