CVE-2026-97204

UNKNOWN 0.0

Gitea label deletion across repository and organization IDs

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.

CWE	CWE-863
Vendor	gitea
Product	gitea
Published	Oct 18, 2026

Stay Ahead of the Next One

Get instant alerts for gitea gitea

Be the first to know when new unknown vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Gitea / Gitea

0 ≤ 28.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-fxq4-gr55-7x5g github.com: https://github.com/go-gitea/gitea/pull/39743 github.com: https://github.com/go-gitea/gitea/pull/39752 blog.gitea.com: https://blog.gitea.com/release-of-28.2.0/ github.com: https://github.com/go-gitea/gitea/releases/tag/v28.2.0

Credits

🔍 https://github.com/N0K0 https://github.com/wxiaoguang