Skip to content
Threat Feed
Subscribe

Product

Gitea (<= V28.2.0)

1 brief RSS
medium advisory

Gitea: Archived repository metadata authorization bypass (CVE-2026-116296)

Gitea versions 28.2.0 and earlier fail to enforce archival read-only status on milestone, release, and label API routes, allowing write-collaborators to modify or delete sensitive project metadata.

Gitea webserver authorization-bypass cve-2026-116296
1r 1t 1c