Gitea: Tag delete route deletes published releases and attachments
Summary
The web route for deleting tags in Gitea shares its handler with release deletion and does not check that the target is a plain tag. A collaborator with write access to the Code unit, but without write access to Releases, can permanently delete published releases of the repository, including their attachments. Protected tag rules that cover the release tag still block the deletion, but this protection is disabled by default and must be configured per repository.
Affected
- Gitea up to and including 28.0.0
- Older releases: Unknown.
Fixed in
- Gitea 28.1.0 (fixed via PR #39501 and PR #39507)
- A newer release (28.2.0) is listed by a third-party source; check the Gitea releases page for the current version.
Workaround
- No official workaround known.
- Partial mitigation: configure tag protection rules that cover release tags and do not allow the affected users.
- Restrict Code write access to trusted users only.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found in the sources searched.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
Our recommendation
- Upgrade Gitea to version 28.1.0 or later.
- Review which users have Code write access to repositories and remove unnecessary rights.
- Ensure backups of release attachments exist before and after patching.
- Verify the current NVD score and advisory details before final prioritisation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gitea 28.1.0 release blog blog.gitea.com
- GHSA-vvqw-mjq8-x248 advisory github.com
- Gitea PR #39501 github.com
- Gitea PR #39507 github.com
- Gitea v28.1.0 release github.com
- OSV CVE-2026-105267 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:40.
Original description (NVD)
The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.