Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Gitea | Gitea | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 15 Nov 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When a release was edited, the files of the attachments to remove were deleted by the identifiers submitted in the form rather than by the attachments verified to belong to the release. A user with write access to the releases of any repository, including their own, could submit a crafted identifier that resolves to the stored file of another attachment and delete it, provided they know that attachment's UUID. The attachment record stayed, so downloads of the affected issue, comment or release file failed. Release edits now only delete the files of attachments that belong to the release. | |
| Title | Gitea deletion of arbitrary attachment files through release edit | |
| Weaknesses | CWE-22 CWE-639 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-11-15T21:14:01.669Z
Reserved: 2026-11-15T20:29:37.615Z
Link: CVE-2026-123065
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.