CVE-2026-97204

Gitea label deletion across repository and organization IDs

State: Published
Severity: 3.1 Low
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Oct 4, 2026

Description

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N	CISA-ADP

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
GiteaGitea	28.1.0 and earlierAffected

References

GitHub Security Advisory GHSA-fxq4-gr55-7x5gvendor-advisory
Fix: go-gitea/gitea pull request #39743patch
Fix backport to release/v28: go-gitea/gitea pull request #39752patch
Gitea 28.2.0 release announcementrelease-notes
go-gitea/gitea v28.2.0 releaserelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.