CVE-2026-118504 Gitea CVE debrief

Who should care

Defenders who manage Gitea instances should assess exposure and prioritize patching or mitigation. They should verify if their Gitea instances are vulnerable and apply patches or mitigations as available. Defenders should also monitor for suspicious activity on archived repositories and restrict API access to authorized users.

Why it matters

CVE-2026-118504 is a vulnerability in Gitea that allows unauthorized changes to archived repositories. Defenders should verify exposure, prioritize patching, and monitor for suspicious activity.

• Verify if Gitea instances are vulnerable and apply patches
• Monitor for suspicious activity on archived repositories
• Restrict API access to authorized users
• Update incident response plans to include Gitea repository monitoring

Technical summary

The vulnerability allowed users with permission to change issues in an archived repository to use the API to edit, close, or delete issues, change labels and deadlines, add or delete tracked time and stopwatches, add reactions, change issue blocks, and pin issues. This could alter data that archiving is meant to freeze. Gitea versions 28.2.0 and 28.3.0 addressed this issue by adding checks to the issue edit, delete, and label routes, and applying it to all modifying repository API requests. The vulnerability was caused by a lack of checks in several issue routes of the REST API.

Defensive priority

Defenders should prioritize verifying if their Gitea instances are vulnerable and apply patches or mitigations as available.

Recommended defensive actions

• Verify if the Gitea instance is vulnerable
• Apply patches or mitigations as available
• Monitor for suspicious activity on archived repositories
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Gitea's official release notes and GitHub pull requests also provide information on the fixes. The vulnerability was addressed in Gitea versions 28.2.0 and 28.3.0. Defenders should verify if their Gitea instances are vulnerable and apply patches or mitigations as available. The fixes involve adding checks to the issue edit, delete, and label routes, and applying it to all modifying repository API requests. Additional information can be found in the official CVE Program

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.