Label Deletion Vulnerability in Gitea by Gitea

CVE-2026-97204

What is CVE-2026-97204?

A vulnerability in Gitea allows users with write access to a repository's issues to inadvertently delete labels belonging to organizations that share the same numeric ID as the repository. This misconfigured access control means that labels intended for use within specific repositories can be removed by users who should not have that level of control over organizational labels. The issue has been addressed to ensure that labels are only deleted within the confines of their respective repository or organization, enhancing overall system security.

References