---
id: CVE-2026-107686
title: Gitea reactions accepted on locked issues and comments
summary: >-
  The Gitea web handlers for adding and removing reactions on issues and
  comments did not refuse locked issues for users without write access, although
  the API did. A signed-in user who could read an issue could therefore add or
  remove rea…
severity: none
vendor: Gitea
product: gitea.dev
affected:
  - gitea.dev <= 28.1.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T18:56:59.087Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107686'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-wx44-9m3m-rjqx'
    label: GitHub Security Advisory GHSA-wx44-9m3m-rjqx
  - url: 'https://github.com/go-gitea/gitea/pull/39839'
    label: 'Fix: go-gitea/gitea pull request #39839'
  - url: 'https://github.com/go-gitea/gitea/pull/39847'
    label: 'Fix backport to release/v28: go-gitea/gitea pull request #39847'
  - url: 'https://blog.gitea.com/release-of-28.2.0/'
    label: Gitea 28.2.0 release announcement
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v28.2.0'
    label: go-gitea/gitea v28.2.0 release
tags:
  - cve.org
ingestedAt: '2026-10-18T19:51:12.338Z'
---

## Overview

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.

## Affected

- `gitea.dev <= 28.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.