CVE-2026-107686

The Gitea web handlers for adding and removing reactions on issues and comments failed to enforce restrictions on locked items for users without write access. Consequently, a signed-in user with read access could add or remove reactions on locked issues and comments , effectively bypassing the in...

CVE-2026-107686 Gitea reactions accepted on locked issues and comments

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the...