Skip to content
Threat Feed
Subscribe
medium advisory

Gitea: Archived repository metadata authorization bypass (CVE-2026-116296)

Gitea versions 28.2.0 and earlier fail to enforce archival read-only status on milestone, release, and label API routes, allowing write-collaborators to modify or delete sensitive project metadata.

CVE search metadata

CVE search record: CVE-2026-116296. KEV: no. Product: Gitea (<= v28.2.0). Brief: Gitea: Archived repository metadata authorization bypass (CVE-2026-116296). Brief link: https://feed.craftedsignal.io/briefs/2026-11-gitea-archived-repo-bypass/

Triage facts

Revision 1
Applicability
Gitea (<= v28.2.0)
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Nov 1, 20:09 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

Gitea repositories configured as "archived" are intended to be permanently read-only. However, due to a missing authorization check (CWE-862) in the API middleware, users with write-collaborator access can bypass these restrictions. While previous security patches (PR #39839) secured Issues and Wikis, the API routes for Milestones, Releases, and Labels remained unprotected. This vulnerability is fixed in Gitea v28.2.1.

Impact

Users with write-collaborator privileges can tamper with historical project data, including deleting or modifying milestones and releases, which compromises the integrity of repositories intended to serve as audit-grade snapshots.

Recommendation

  • Upgrade all Gitea instances running versions <= v28.2.0 to v28.2.1 or later.
  • Audit logs for API write activity on repositories marked as archived to identify potential unauthorized modifications.

Immediate actions

Upgrade Gitea to v28.2.1 or later on all instances.

IT Operations 48h

Threat Hunt

Search webserver logs for write-methods (POST, PATCH, DELETE) to milestone, release, or label API endpoints targeted at archived repositories.

T1068 high high confidence hunt now

Data: webserver access logs containing cs-uri-stem and sc-status

Mitigations

Upgrade Gitea to v28.2.1 or later.

immediate IT Operations

CVE-2026-116296

Detection coverage 1

Detect Gitea Archived Repository Metadata Tampering (CVE-2026-116296)

medium

Detects potential exploitation of CVE-2026-116296 by monitoring API requests to milestones, releases, or labels on archived Gitea repositories.

sigma tactics: privilege-escalation techniques: T1068 sources: webserver

Detection queries are available on the platform. Get full rules →