Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-105267 Details

Description

The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://blog.gitea.com/release-of-28.1.0/	Gitea Limited
https://github.com/go-gitea/gitea/pull/39501	Gitea Limited
https://github.com/go-gitea/gitea/pull/39507	Gitea Limited
https://github.com/go-gitea/gitea/releases/tag/v28.1.0	Gitea Limited
https://github.com/go-gitea/gitea/security/advisories/GHSA-vvqw-mjq8-x248	Gitea Limited

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-732	Incorrect Permission Assignment for Critical Resource	Gitea Limited
CWE-863	Incorrect Authorization	Gitea Limited

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes