CVE-2026-118504 Details
Description
The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository is archived. A user allowed to change issues of an archived repository could use the API to edit, close or delete issues, change labels and deadlines, add or delete tracked time and stopwatches, add reactions, change issue blocks, and pin issues, altering data that archiving is meant to freeze. Gitea 28.2.0 added the check to the issue edit, delete and label routes; Gitea 28.3.0 applies it to all modifying repository API requests.
A vulnerability exists in the Gitea API that allows users with write access to bypass archive restrictions on issues in archived repositories. While the web interface properly blocks changes to issues in archived repositories, several issue-related routes in the REST API do not enforce this check. As a result, users can use the API to edit, close, or delete issues, change labels and deadlines, manage tracked time and stopwatches, add reactions, modify issue blocks, and pin issues in archived repositories, undermining the intended read-only status.
Upgrade to Gitea version 28.3.0, which applies the necessary archive checks to all issue mutation routes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-28.3.0/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39839 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/39847 | Gitea Limited | Issue TrackingSource CodeVendor |
| https://github.com/go-gitea/gitea/pull/39942 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/40085 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-vmrc-8q2x-573x | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 28.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | Gitea Limited |