Vulnerability in Gitea Web Handlers Affected by User Permissions Misconfiguration

CVE-2026-107686

What is CVE-2026-107686?

The Gitea web handlers for managing reactions on issues and comments improperly handle user permissions. Specifically, users with read access to a locked issue can add or remove reactions despite lacking write permissions, circumventing the intended restrictions. This issue affects only the reactions and does not allow any modification to the content itself. Ensuring that the API and web handlers enforce consistent permission checks is critical for maintaining the integrity of user interactions in Gitea.

References