CVE-2026-105267

The Gitea web application is vulnerable to an incorrect authorization issue where the tag deletion route (POST /{owner}/{repo}/tags/delete) fails to verify if the target is a plain tag. Because this route shares a handler with release deletion, a collaborator with Code write access but lacking Re...