CVE-2026-105267

Summary

A collaborator with write access to repository code can accidentally delete published releases by using the tag deletion endpoint, even without release deletion permissions. This bypasses protection rules that should have prevented deletion of release tags.

Exploitability

Exploitation requires a collaborator with Code write access who knows the repository structure and can make POST requests to the tag deletion endpoint, which is relatively straightforward given the shared handler logic.

Blast radius

The impact could be significant for projects relying on release management, as collaborators might permanently delete important releases including their attachments, potentially affecting downstream users and CI/CD pipelines.

Detection

Monitor for POST requests to /{owner}/{repo}/tags/delete endpoints in web server logs, particularly when accompanied by release-related metadata or attachments in request payloads.

Prioritized remediation

Upgrade to Gitea 2.590 or later to fix the tag deletion logic that incorrectly allows code writers to delete releases.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.