CVE-2026-123065

not scored yet · published 2026-11-15

When a release was edited, the files of the attachments to remove were deleted by the identifiers submitted in the form rather than by the attachments verified to belong to the release. A user with write access to the releases of any repository, including their own, could submit a crafted identifier that resolves to the stored file of another attachment and delete it, provided they know that attachment's UUID. The attachment record stayed, so downloads of the affected issue, comment or release file failed. Release edits now only delete the files of attachments that belong to the release.

Weakness: CWE-22, CWE-639

Source: NVD CVE-2026-123065

References

• https://blog.gitea.com/release-of-28.4.0/
• https://github.com/go-gitea/gitea/pull/40120
• https://github.com/go-gitea/gitea/pull/40268
• https://github.com/go-gitea/gitea/releases/tag/v28.4.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-4p89-xcq8-xfhm

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.