CVE-2026-97204: Gitea label deletion across repository and organization IDs

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-19
Weakness: CWE-863

Description

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.

Affected products

Gitea Open Source Git Server: through 28.1.0

References

https://blog.gitea.com/release-of-28.2.0/
https://github.com/go-gitea/gitea/pull/39743
https://github.com/go-gitea/gitea/pull/39752
https://github.com/go-gitea/gitea/releases/tag/v28.2.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-fxq4-gr55-7x5g

Get alerted when CVE-2026-97204 or the next vulnerability affects your stack