CVE-2026-107686

CVE-2026-107686 · Gitea reactions accepted on locked issues and comments

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.

CVSS 4.3 · Средний · EPSS 0,2%

Опубликовано

2026-10-18T18:56:59.087Z

Обновлено

2026-10-19T20:15:58.164Z

Проверьте свой сервер →