CVE-2026-107686— Gitea reactions accepted on locked issues and comments
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gitea 中用于在问题和评论上添加或移除表情反应的 Web 处理程序，未能拒绝无写权限用户对已锁定问题的操作请求，尽管其 API 端点已正确执行了该限制。因此，任何已登录且具备问题读取权限的用户，均可在已锁定的问题及其评论上添加或移除表情反应，从而绕过了锁定机制所施加的交互限制。此漏洞仅影响表情反应功能，无法用于修改任何实际内容。
Possible ATT&CK Techniques 1 AI
T1551.003
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107686
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea reactions accepted on locked issues and comments
Source: CVE Program / CVE List V5
Vulnerability Description
The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-107686
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107686
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-107686 (2)
Vendor Advisories for CVE-2026-107686 (1)
Other References for CVE-2026-107686 (1)
-
https://blog.gitea.com/release-of-28.2.0/ release-notes
Same Patch Batch · Gitea · 2026-10-18 · 12 CVEs total
| CVE-2026-109553 | Gitea SSH certificate principal impersonation of other users | |
| CVE-2026-104627 | Gitea OpenID account linking without session binding | |
| CVE-2026-105661 | Gitea panic on the repositories route of individual users | |
| CVE-2026-105964 | Gitea Actions artifact v4 API unbounded request body | |
| CVE-2026-109844 | Gitea watched repositories API disclosure after access revocation | |
| CVE-2026-107618 | Gitea cross-site request forgery on repository topics | |
| CVE-2026-110494 | Gitea release attachment re-linking of issue attachments | |
| CVE-2026-110324 | Gitea private profile information disclosure through POST request | |
| CVE-2026-110311 | Gitea draft release creation disclosing attachment metadata | |
| CVE-2026-97204 | Gitea label deletion across repository and organization IDs | |
| CVE-2026-97859 | Gitea API disclosure of private user social graph, keys and stars |
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-97859
Gitea API disclosure of private user social graph, keys and -
CVE-2026-97204
Gitea label deletion across repository and organization IDs -
CVE-2026-110494
Gitea release attachment re-linking of issue attachments -
CVE-2026-110324
Gitea private profile information disclosure through POST re -
CVE-2026-110311
Gitea draft release creation disclosing attachment metadata
Same vendor: Gitea
-
CVE-2026-97859
Gitea API disclosure of private user social graph, keys and -
CVE-2026-97204
Gitea label deletion across repository and organization IDs -
CVE-2026-110494
Gitea release attachment re-linking of issue attachments -
CVE-2026-110324
Gitea private profile information disclosure through POST re -
CVE-2026-110311
Gitea draft release creation disclosing attachment metadata
V. Comments for CVE-2026-107686
No comments yet