CVE-2026-105268

MediumCVSS 4.3/10Last modified Oct 13, 2026

Description

The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Oct 6, 2026
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1052696.8Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operato CVE-2026-105276.3Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role CVE-2026-1052708.7Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to e CVE-2026-1052715.1"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain CVE-2026-1052737.5MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process t CVE-2026-1052742.1Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a CVE-2026-1052754.3Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authentica CVE-2026-1052789.8The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with netwo CVE-2026-1052799.1In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET CVE-2026-105283.3A security flaw has been discovered in Orthanc DICOM Server up to 1.12.11. This issue affects the function DcmItem::read of the file Orthanc CVE-2026-1052806.9Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.packa CVE-2026-1052817.5The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated n