REST API Vulnerability in Gitea Affects Archived Repositories
CVE-2026-118504

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
1 November 2026

What is CVE-2026-118504?

A vulnerability in Gitea's REST API allows users to perform unauthorized actions on issues within archived repositories. While the web interface prevents changes to these repositories, several API endpoints did not incorporate checks for the archived status, which could enable users to edit, close, delete issues, modify labels, and alter tracked time. This could result in unauthorized alterations to data that is intended to remain frozen. Gitea versions 28.2.0 and 28.3.0 addressed these issues by implementing necessary checks in the API's modifying repository requests.

Affected Version(s)

Gitea 0 < 28.3.0

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/39839
patch
https://github.com/go-gitea/gitea/pull/39847
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/DevNoScope
https://github.com/nithissh7
https://github.com/bircni
.