{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agiteagitea/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-116296"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gitea (\u003c= v28.2.0)"],"_cs_severities":["medium"],"_cs_tags":["webserver","authorization-bypass","cve-2026-116296"],"_cs_type":"advisory","_cs_vendors":["Gitea"],"content_html":"\u003cp\u003eGitea repositories configured as \u0026quot;archived\u0026quot; are intended to be permanently read-only. However, due to a missing authorization check (CWE-862) in the API middleware, users with write-collaborator access can bypass these restrictions. While previous security patches (PR #39839) secured Issues and Wikis, the API routes for Milestones, Releases, and Labels remained unprotected. This vulnerability is fixed in Gitea v28.2.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUsers with write-collaborator privileges can tamper with historical project data, including deleting or modifying milestones and releases, which compromises the integrity of repositories intended to serve as audit-grade snapshots.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Gitea instances running versions \u0026lt;= v28.2.0 to v28.2.1 or later.\u003c/li\u003e\n\u003cli\u003eAudit logs for API write activity on repositories marked as archived to identify potential unauthorized modifications.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T20:09:55Z","date_published":"2026-11-01T20:09:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-gitea-archived-repo-bypass/","summary":"Gitea versions 28.2.0 and earlier fail to enforce archival read-only status on milestone, release, and label API routes, allowing write-collaborators to modify or delete sensitive project metadata.","title":"Gitea: Archived repository metadata authorization bypass (CVE-2026-116296)","url":"https://feed.craftedsignal.io/briefs/2026-11-gitea-archived-repo-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}