Skip to content
Heist/ feed
Back to feed
Low

Gitea label deletion across repository and organization IDs

Type: advisorySources: OSV

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-97204
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 02:41 UTC · Revision 1

Source evidence

Gitea label deletion across repository and organization IDs

core-osv · Original source

Published 18 Oct 2026, 19:00 UTC

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.

osv:CVE-2026-97204
Complete source record
{
  "id": "cadefce1615ae625a4493200cc7a352c9673991dd6a1edd9abf3432aa987b09d",
  "url": "https://osv.dev/vulnerability/CVE-2026-97204",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Gitea label deletion across repository and organization IDs",
    "summary": "Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.",
    "evidence": "osv:CVE-2026-97204",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2026-97204",
      "aliases": [
        "CVE-2026-97204",
        "GHSA-fxq4-gr55-7x5g"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/go-gitea/gitea",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "829b49c1ae96015e345f9d2a0eb1ea7acd5f31e1"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "28.1.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "829b49c1ae96015e345f9d2a0eb1ea7acd5f31e1"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v28.2.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v28.1.0",
            "v28.0.0",
            "v29.0.0-dev",
            "v1.28.0-dev",
            "v1.27.0-dev",
            "v1.26.0-dev",
            "v1.25.0-dev",
            "v1.24.0-dev",
            "v1.22.0-rc1",
            "v1.23.0-dev",
            "v1.22.0-rc0",
            "v1.21.0-rc0",
            "v1.22.0-dev",
            "v1.20.0-rc0",
            "v1.21.0-dev",
            "v1.20.0-dev",
            "v1.19.0-rc0",
            "v1.18.0-rc0",
            "v1.19.0-dev",
            "v1.18.0-dev",
            "v1.17.0-dev",
            "v1.16.0-rc1",
            "v1.15.0-rc1",
            "v1.16.0-dev",
            "v1.15.0-dev",
            "v1.14.0-dev",
            "v1.13.0-dev",
            "v1.12.0-dev",
            "v1.10.5",
            "v1.11.0-rc1",
            "v1.10.0-rc1",
            "v1.11.0-dev",
            "v1.9.0-rc1",
            "v1.10.0-dev",
            "v1.9.0-dev",
            "v1.7.0-dev",
            "v1.6.0-rc1",
            "v1.6.0-dev",
            "v1.5.0-rc1",
            "v1.5.0-dev",
            "v1.1.0",
            "v1.0.0",
            "v0.9.99"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97204.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:46.194347353Z",
      "provider": "osv",
      "references": [
        "https://blog.gitea.com/release-of-28.2.0/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97204.json",
        "https://github.com/go-gitea/gitea/releases/tag/v28.2.0",
        "https://github.com/go-gitea/gitea/security/advisories/GHSA-fxq4-gr55-7x5g",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-97204",
        "https://github.com/go-gitea/gitea/pull/39743",
        "https://github.com/go-gitea/gitea/pull/39752"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-863"
        ],
        "cna_assigner": "Gitea",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97204.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-97204",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 514370,
  "published_at": "2026-10-18T19:00:50.994+00:00"
}