CVE-2026-116296 Details
Description
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download URLs, delete releases and tags, and create, edit or delete milestones and labels of a repository that is meant to be read-only. Changing requests on these routes now return 423 Locked for archived repositories.
A vulnerability exists in Gitea's API that allows users with write access to archived repositories to bypass the intended read-only status. This issue affects Gitea versions through 28.2.0. The vulnerability arises because the API routes for releases, milestones, and labels do not enforce the archived repository restriction. As a result, a user can replace or delete release assets while retaining their download URLs, delete releases and tags, and manipulate milestones and labels in a repository that should be immutable.
Users are advised to update to Gitea version 28.3.0, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-28.3.0/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39942 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/pull/40085 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-6h2f-c8jm-84hc | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 28.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | Gitea Limited |