API Vulnerability in Gitea Affecting Archived Repositories

CVE-2026-116296

What is CVE-2026-116296?

The Gitea platform contains a vulnerability in its API routes designed for managing releases, release assets, milestones, and repository labels. This flaw allows users with write access to archived repositories to overwrite or delete release assets while preserving their download links. Furthermore, it enables unauthorized deletion of releases and tags as well as modifications to milestones and labels within repositories designated as read-only. As a remedial action, requests attempting to alter archived repositories are now met with a '423 Locked' response.

References