CVE-2026-105267: Gitea tag delete route deletes releases without release permission

Vulnerability summary

CVE-2026-105267 is a high (CVSS 8.1) vulnerability in gitea. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.5% of scored vulnerabilities.

Timeline

1. 06-10-2026
   PublishedVulnerability first disclosed.
2. 07-10-2026
   Last modifiedVulnerability information updated.

Description

The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion.

• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.