CVE-2026-97204 Gitea CVE debrief

Who should care

Gitea administrators, developers, and users with write access to repository issues should assess exposure and apply patches to prevent label deletion across repository and organization IDs.

Why it matters

The vulnerability in Gitea allows users with write access to a repository's issues to delete labels of an organization with the same numeric ID as the repository, potentially leading to unauthorized label deletion and data loss.

• Defenders must verify Gitea instance versions and configurations to identify potential exposure.
• Applying patches or updates to Gitea instances is necessary to prevent label deletion across repository and organization IDs.
• Monitoring Gitea instance logs for suspicious label deletion activity is crucial to detect potential exploitation.
• Reviewing access controls and permissions for Gitea repository and organization administrators is essential to prevent unauthorized label deletion.

Technical summary

The vulnerability in Gitea allows users with write access to a repository's issues to delete labels of an organization with the same numeric ID as the repository. This occurs because the label deletion process compares the repository ID in the request with the organization ID of organization labels, and the two ID sequences overlap. To address this issue, Gitea has implemented a fix that ensures labels are deleted only within their own repository or organization.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Gitea instances, especially those with overlapping repository and organization IDs.

Recommended defensive actions

• Verify Gitea instance versions and configurations to identify potential exposure.
• Apply patches or updates to Gitea instances to prevent label deletion across repository and organization IDs.
• Monitor Gitea instance logs for suspicious label deletion activity.
• Review access controls and permissions for Gitea repository and organization administrators.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, while vendor advisories and patch notes offer remediation guidance. The vulnerability allows users with write access to a repository's issues to delete labels of an organization with the same numeric ID as the repository. This occurs because the label deletion process compares the repository ID in the request with the organization ID of organization labels, and the two ID sequences overlap. The fix ensures labels are deleted only within their own repository or Gitea

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.