Vulnerability · Published Oct 18, 2026 · Assigned by Gitea

CVE-2026-107686Gitea reactions accepted on locked issues and comments

Medium 4.3

In plain English

A medium-severity improper access control in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 85.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 28.1.0

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory GHSA-wx44-9m3m-rjqx vendor-advisory
Fix: go-gitea/gitea pull request #39839 patch
Fix backport to release/v28: go-gitea/gitea pull request #39847 patch
Gitea 28.2.0 release announcement release-notes
go-gitea/gitea v28.2.0 release release-notes