Cve-2026-116296 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-116296/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 01 Nov 2026 20:09:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGitea: Archived repository metadata authorization bypass (CVE-2026-116296)https://feed.craftedsignal.io/briefs/2026-11-gitea-archived-repo-bypass/Sun, 01 Nov 2026 20:09:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-gitea-archived-repo-bypass/Gitea versions 28.2.0 and earlier fail to enforce archival read-only status on milestone, release, and label API routes, allowing write-collaborators to modify or delete sensitive project metadata.Gitea repositories configured as "archived" are intended to be permanently read-only. However, due to a missing authorization check (CWE-862) in the API middleware, users with write-collaborator access can bypass these restrictions. While previous security patches (PR #39839) secured Issues and Wikis, the API routes for Milestones, Releases, and Labels remained unprotected. This vulnerability is fixed in Gitea v28.2.1.

Impact

Users with write-collaborator privileges can tamper with historical project data, including deleting or modifying milestones and releases, which compromises the integrity of repositories intended to serve as audit-grade snapshots.

Recommendation

  • Upgrade all Gitea instances running versions <= v28.2.0 to v28.2.1 or later.
  • Audit logs for API write activity on repositories marked as archived to identify potential unauthorized modifications.
]]>mediumadvisorywebserverauthorization-bypasscve-2026-116296