CVE-2026-107686: Gitea Auth Bypass Vulnerability

CVE-2026-107686 Overview

CVE-2026-107686 is a broken access control vulnerability in Gitea, a self-hosted Git service written in Go. The web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access. The equivalent API endpoints enforced the restriction correctly, creating an inconsistency between the two interfaces. A signed-in user with read access could add or remove reactions on a locked issue and its comments through the web interface, bypassing the interaction lock. The flaw affects only reactions; no issue or comment content could be modified.

Critical Impact
Authenticated users with read-only access can bypass the interaction restriction of locked issues to add or remove reactions through the Gitea web interface.

Affected Products

Gitea self-hosted Git service
Gitea versions prior to v28.2.0
Gitea web handlers for issue and comment reactions

Discovery Timeline

2026-10-18 - CVE-2026-107686 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-107686

Vulnerability Analysis

The vulnerability resides in Gitea's web handlers responsible for processing reaction actions on issues and comments. When an issue is locked, Gitea is expected to restrict interactions to users with write access on the repository. The API layer enforced this check, but the corresponding web handlers did not. A signed-in user who could read the issue could therefore submit reaction add or remove requests through the web UI and have them succeed.

The impact is limited to reactions. No textual content, issue state, or metadata can be modified through this path. The practical consequence is a bypass of the social-interaction restriction that locking is intended to enforce, which can be used to harass or signal on discussions that maintainers have explicitly closed to further interaction.

Root Cause

The root cause is inconsistent authorization enforcement between the API and web handlers [Broken Access Control]. The web handlers for reaction add and remove operations omitted the check that rejects actions on locked issues when the caller lacks write access. The API handlers performed this check correctly, exposing the gap only through the web path.

Attack Vector

Exploitation requires an authenticated account with read access to the target repository. The attacker issues a reaction add or remove request through the web interface against a locked issue or one of its comments. No elevated privileges, user interaction, or additional access are required. See the GitHub Security Advisory GHSA-wx44-9m3m-rjqx and the fix in Gitea Pull Request #39839 for full technical details.

Detection Methods for CVE-2026-107686

Indicators of Compromise

Reaction add or remove events on issues marked as locked, performed by users without repository write access.
Web request logs showing POST or DELETE requests to reaction endpoints under /issues/ or /comments/ paths against locked issues.
Audit log entries attributing reaction changes to read-only collaborators on closed or locked threads.

Detection Strategies

Correlate Gitea application logs with issue lock state and user permission level to identify reactions applied after the lock timestamp by non-write users.
Query the Gitea database for reaction records whose creation time is later than the lock time of the parent issue, filtered to users without write permission.
Review access logs for anomalous bursts of reaction activity on previously locked issues.

Monitoring Recommendations

Forward Gitea access and application logs to a centralized log platform and alert on reaction mutations against locked issues.
Track reaction counts on locked issues over time; sudden deltas indicate possible exploitation.
Baseline normal reaction activity per user role and alert on deviations from read-only accounts.

How to Mitigate CVE-2026-107686

Immediate Actions Required

Upgrade Gitea to version v28.2.0 or later, which contains the fix from Gitea Pull Request #39839 and Gitea Pull Request #39847.
Inventory existing Gitea instances and confirm versions against the Gitea v28.2.0 Release Notes.
Review audit logs for reaction activity on locked issues by read-only accounts prior to patching.

Patch Information

Gitea addressed CVE-2026-107686 in version v28.2.0. The release aligns the web handler authorization logic with the API behavior so that reaction add and remove requests on locked issues are refused for users without write access. Details are available in the Gitea v28.2.0 Release Announcement.

Workarounds

Restrict read access on sensitive repositories to trusted users until the upgrade is applied.
Reduce the use of issue locking as a sole social-control mechanism on unpatched instances; consider restricting repository visibility instead.
Place Gitea behind a reverse proxy or WAF rule that blocks reaction endpoints for identified read-only accounts on locked issues where feasible.

bash

# Configuration example: upgrade Gitea on a Linux host using the binary release
systemctl stop gitea
cp /usr/local/bin/gitea /usr/local/bin/gitea.bak
curl -L -o /usr/local/bin/gitea \
  https://github.com/go-gitea/gitea/releases/download/v28.2.0/gitea-28.2.0-linux-amd64
chmod +x /usr/local/bin/gitea
sudo -u git /usr/local/bin/gitea --version
systemctl start gitea