CVE-2026-105268
Description
A flaw was found in Gitea. The Application Programming Interface (API) endpoints handling issue attachments improperly process attachments associated with comments on that issue. An authenticated user who created an issue can exploit this flaw to rename or delete attachments posted by other users in comments on that issue.
Statement
A vulnerability of moderate impact was found in Gitea, which is bundled in Red Hat's Konflux OpenShift Pipelines container images (Pipelines as Code controller and watcher). The Gitea issue attachment API routes (/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}) validated that an attachment belongs to the repository and the issue, but never checked that it belongs to the issue itself rather than to a comment on that issue. As a result, an authenticated user whose only relationship to a repository is having opened an issue could rename or delete attachments that other users had posted in comments on that issue. The content of those attachments could not be read or modified; only the filename could be changed or the file deleted, so there is no confidentiality impact and only low integrity and availability impact (RH CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). The CISA score of 4.3 is slightly lower because it does not count the availability impact of deleted attachments. For the affected Konflux components the fix is deferred: the flaw is moderate severity with a CVSS score below 7.0, and no tracker is filed for moderate severity flaws without a high CVSS. The residual risk is limited to an authenticated issue opener renaming or deleting other users' comment attachments on issues they created.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Gitea project addressed this flaw in Gitea 28.1.0; because the fix for the affected Red Hat Konflux images is deferred, no fixed Red Hat version is currently available.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
