Vulnerability · Published Oct 18, 2026 · Assigned by Gitea

CVE-2026-97204Gitea label deletion across repository and organization IDs

Low 3.1

In plain English

A low-severity incorrect authorization in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.2%top 91.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 28.1.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory GHSA-fxq4-gr55-7x5g vendor-advisory
Fix: go-gitea/gitea pull request #39743 patch
Fix backport to release/v28: go-gitea/gitea pull request #39752 patch
Gitea 28.2.0 release announcement release-notes
go-gitea/gitea v28.2.0 release release-notes