Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118504— Gitea issue changes on archived repositories through the API

Quick assessment

Affected

Gitea Gitea

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Web 界面会阻止对已归档仓库的 Issue（问题）和 Pull Request（拉取请求）进行修改，但 REST API 中的多个 Issue 相关路由未检查仓库是否已归档。若某用户被允许修改已归档仓库中的 Issue，则可通过 API 执行编辑、关闭或删除 Issue、修改标签和截止日期、添加或删除跟踪时间与计时器、添加表情反应、更改 Issue 锁定状态以及置顶 Issue 等操作，从而篡改本应通过归档机制冻结的数据。Gitea 28.2.0 版本已在 Issue 的编辑、删除和标签路由中添加了该检查；Git

AI Predicted 6.5 Difficulty: Moderate Updated Nov 01, 2026

Possible ATT&CK Techniques 2 AI

T1562.006 T1562.001

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Gitea	Gitea	`< 28.3.0`	affected

Updated Nov 01, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Gitea issue changes on archived repositories through the API

Source: CVE Program / CVE List V5

Vulnerability Description

The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository is archived. A user allowed to change issues of an archived repository could use the API to edit, close or delete issues, change labels and deadlines, add or delete tracked time and stopwatches, add reactions, change issue blocks, and pin issues, altering data that archiving is meant to freeze. Gitea 28.2.0 added the check to the issue edit, delete and label routes; Gitea 28.3.0 applies it to all modifying repository API requests.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Gitea	Gitea	0 ~ 28.3.0	-

II. Public POCs for CVE-2026-118504

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118504

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118504 (2)

Other References for CVE-2026-118504 (5)

https://github.com/go-gitea/gitea/releases/tag/v28.3.0 release-notes
https://blog.gitea.com/release-of-28.3.0/ release-notes
https://github.com/go-gitea/gitea/pull/39942 patch
https://github.com/go-gitea/gitea/security/advisories/GHSA-vmrc-8q2x-573x vendor-advisory
https://github.com/go-gitea/gitea/pull/40085 patch

https://www.cve.org/CVERecord?id=CVE-2026-118504

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117646		Gitea private repository listing to public-only tokens on profiles
CVE-2026-118386		Gitea Actions fork workflow trust through pull request review commit
CVE-2026-120263		Gitea OAuth2 account auto-linking takeover through the sign-up form
CVE-2026-112887		Gitea Actions task token private repository enumeration
CVE-2026-113429		Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199		Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289		Gitea public-only token bypass through Actions runner registration
CVE-2026-116296		Gitea archived repository release, milestone and label modification
CVE-2026-116474		Gitea Actions job token spoofing of instance-signed commits
CVE-2026-117635		Gitea admin API public-only token scope bypass
CVE-2026-119627		Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117649		Gitea private issue disclosure through issue dependency timeline events
CVE-2026-117677		Gitea Helm chart upload decompression denial of service
CVE-2026-117685		Gitea public-only package token access to private OCI blobs
CVE-2026-118394		Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395		Gitea public-only token bypass in repository and organization creation
CVE-2026-119441		Gitea public-only token bypass on bulk organization repository deletion
CVE-2026-119533		Gitea private pull request disclosure on project boards
CVE-2026-119625		Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea

Same vendor: Gitea