Live › vulnerability › CVE-2026-107686
Go to dashboardGitea's web handlers for adding and removing reactions on issues and comments skipped the locked-issue check that the API enforces. A signed-in user who can read a locked issue can add or remove reactions on it and its comments, bypassing the lock's interaction restriction.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Gitea instance where signed-in users can read issues that maintainers have locked. Only reactions are affected and no content can be changed, so the impact is limited to reaction spam or manipulation on locked threads. Instances without locked issues or with anonymous-only access are unlikely to matter.
No product ranges from the sources yet.
gitea --version on the server or check the version shown in the admin dashboard and compare it with the fixed release in the advisory.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.
This page as .md · .json · in your agent: get_signal("CVE-2026-107686")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.