CVE-2026-97204: Gitea label deletion across repository and organization IDs
Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user needs write access to issues in a repository. Exploitation also requires that the target organization has the same numeric ID as that repository.
What is the impact if the ID values overlap?
The user can delete labels belonging to the matching organization, despite having write access only to the repository's issues.
How can exposure be assessed?
Identify repositories where users have write access to issues and compare their numeric repository IDs with organization IDs. A matching repository and organization ID creates the condition described for cross-scope label deletion.