{"id":"CVE-2026-107686","kind":"vulnerability","aliases":["CVE-2026-107686"],"related":[],"title":"Gitea: locked issues accept reactions from users without write access","description":"The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.","summary":"Gitea's web handlers for adding and removing reactions on issues and comments skipped the locked-issue check that the API enforces. A signed-in user who can read a locked issue can add or remove reactions on it and its comments, bypassing the lock's interaction restriction.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gitea","other","self-hosted"],"not_affected_if":["anonymous-only-access","no-locked-issues"],"how_to_check":"- Run `gitea --version` on the server or check the version shown in the admin dashboard and compare it with the fixed release in the advisory.\n- Confirm whether the instance has any locked issues where read-only users could react, if that matters to your workflow.","fix":"- Upgrade Gitea to a release that includes the fix for CVE-2026-107686; the fixed version number is unknown from the sources.","status":"open","published_at":"2026-10-18T19:16:32+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:39:46+00:00","updated_at":"2026-10-25T04:39:46+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T04:39:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Gitea to a release that includes the fix for CVE-2026-107686; the fixed version number is unknown from the sources.","reach":"network","title":"Gitea: locked issues accept reactions from users without write access","impact":"low","summary":"Gitea's web handlers for adding and removing reactions on issues and comments skipped the locked-issue check that the API enforces. A signed-in user who can read a locked issue can add or remove reactions on it and its comments, bypassing the lock's interaction restriction.","category":"other","nicknames":[],"who_cares":["gitea","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Signed-in users change reactions on locked issues and their comments.","analyst_note":"","how_to_check":"- Run `gitea --version` on the server or check the version shown in the admin dashboard and compare it with the fixed release in the advisory.\n- Confirm whether the instance has any locked issues where read-only users could react, if that matters to your workflow.","needs_analyst":false,"not_affected_if":["no-locked-issues","anonymous-only-access"],"who_is_affected":"Any Gitea instance where signed-in users can read issues that maintainers have locked. Only reactions are affected and no content can be changed, so the impact is limited to reaction spam or manipulation on locked threads. Instances without locked issues or with anonymous-only access are unlikely to matter.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000594,"input_tokens":3325,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107686':13A,16A '-2026':12A,15A 'accept':4A 'access':10A,94C 'add':27B,57B,77C,111C 'affect':132C 'although':95C 'api':43B,97C 'bypass':66B,122C 'chang':137C 'check':40B 'comment':34B,65B,84C,121C 'content':134C 'could':105C,109C,135C 'cve':11A,14A 'enforc':44B 'gitea':1A,17B,22B,73C 'handler':25B,75C 'host':21B 'interact':70B,124C 'issu':3A,32B,39B,55B,82C,89C,108C,118C 'lock':2A,38B,54B,68B,88C,117C,128C 'locked-issu':37B 'reaction':5A,30B,60B,80C,114C,130C 'read':52B,106C 'refus':87C 'remov':29B,59B,79C,113C 'restrict':71B,125C 'self':20B 'self-host':19B 'sign':47B,101C 'signed-in':46B,100C 'skip':35B 'therefor':110C 'user':7A,49B,91C,103C 'web':24B,74C 'without':8A,92C 'write':9A,93C","nicknames":[],"mitigations":[],"who_affected":"Any Gitea instance where signed-in users can read issues that maintainers have locked. Only reactions are affected and no content can be changed, so the impact is limited to reaction spam or manipulation on locked threads. Instances without locked issues or with anonymous-only access are unlikely to matter.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T19:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107686","severity":null,"published_at":"2026-10-18T19:16:32+00:00","modified_at":"2026-10-19T21:17:04+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}