CVE-2026-97204

EUVD-2026-103992
Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GiteaCNA
3.1 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.66%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
giteagitea
𝑥
≤ 28.1.0
CNA
Common Weakness Enumeration
References
https://blog.gitea.com/release-of-28.2.0/
https://github.com/go-gitea/gitea/pull/39743
https://github.com/go-gitea/gitea/pull/39752
https://github.com/go-gitea/gitea/releases/tag/v28.2.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-fxq4-gr55-7x5g