CVE-2026-97204 — Gitea label deletion across repository and organization IDs
Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access …
Published: 2026-10-18 · CVSS: 3.1 · CVSS 3.1
Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7