Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-116296— Gitea archived repository release, milestone and label modification

Quick assessment

Affected

Gitea Gitea

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

发布（releases）、发布资产（release assets）、里程碑（milestones）以及仓库标签（repository labels）的 API 路由未能拒绝针对已归档仓库的变更请求。拥有已归档仓库写入权限的用户，或持有该用户写入作用域 Token 的持有者，均可在保留下载 URL 的情况下替换或删除发布资产，删除发布版本和标签，并对本应只读的仓库创建、编辑或删除里程碑和标签。现已修复：针对这些路由的变更请求在遇到已归档仓库时，将返回 423 Locked（已锁定）状态码。

AI Predicted 6.5 Difficulty: Trivial Updated Nov 01, 2026

Possible ATT&CK Techniques 3 AI

T1070 · Indicator Removal T1190 · Exploit Public-Facing Application T1562

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Gitea	Gitea	`< 28.3.0`	affected

Updated Nov 01, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Gitea archived repository release, milestone and label modification

Source: CVE Program / CVE List V5

Vulnerability Description

The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download URLs, delete releases and tags, and create, edit or delete milestones and labels of a repository that is meant to be read-only. Changing requests on these routes now return 423 Locked for archived repositories.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Gitea	Gitea	0 ~ 28.3.0	-

II. Public POCs for CVE-2026-116296

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116296

请登录查看更多情报信息。

Other References for CVE-2026-116296 (5)

https://github.com/go-gitea/gitea/releases/tag/v28.3.0 release-notes
https://blog.gitea.com/release-of-28.3.0/ release-notes
https://github.com/go-gitea/gitea/pull/39942 patch
https://github.com/go-gitea/gitea/security/advisories/GHSA-6h2f-c8jm-84hc vendor-advisory
https://github.com/go-gitea/gitea/pull/40085 patch

https://www.cve.org/CVERecord?id=CVE-2026-116296

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117649		Gitea private issue disclosure through issue dependency timeline events
CVE-2026-118386		Gitea Actions fork workflow trust through pull request review commit
CVE-2026-120263		Gitea OAuth2 account auto-linking takeover through the sign-up form
CVE-2026-112887		Gitea Actions task token private repository enumeration
CVE-2026-113429		Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199		Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289		Gitea public-only token bypass through Actions runner registration
CVE-2026-116474		Gitea Actions job token spoofing of instance-signed commits
CVE-2026-117635		Gitea admin API public-only token scope bypass
CVE-2026-117646		Gitea private repository listing to public-only tokens on profiles
CVE-2026-119627		Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117677		Gitea Helm chart upload decompression denial of service
CVE-2026-117685		Gitea public-only package token access to private OCI blobs
CVE-2026-118394		Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395		Gitea public-only token bypass in repository and organization creation
CVE-2026-118504		Gitea issue changes on archived repositories through the API
CVE-2026-119441		Gitea public-only token bypass on bulk organization repository deletion
CVE-2026-119533		Gitea private pull request disclosure on project boards
CVE-2026-119625		Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea

Same vendor: Gitea

Same weakness: CWE-862