Cve-2026-116296

Gitea versions 28.2.0 and earlier fail to enforce archival read-only status on milestone, release, and label API routes, allowing write-collaborators to modify or delete sensitive project metadata.