CVE-2026-97204

Received Received - Intake

Label Deletion Issue in GitHub Repository

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-97204

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability involves a logic flaw where deleting a label in a repository incorrectly compared repository IDs with organization IDs. Since these IDs overlap numerically, a user with write access to a repository could delete labels belonging to an organization that shares the same numeric ID as the repository.

Detection Guidance

This vulnerability involves incorrect label deletion in Gitea due to overlapping ID sequences between repositories and organizations. To detect it, check Gitea logs for unauthorized label deletions or mismatched repository/organization IDs. Review access logs for users with write permissions performing label operations. Ensure label deletion is scoped correctly within repositories or organizations.

Impact Analysis

If you are a user with write access to a repository, an attacker could exploit this to delete organization labels, potentially disrupting workflows, misclassifying issues, or causing confusion in label-based organization systems.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it involves unauthorized deletion of labels within a repository or organization context rather than data breaches or privacy violations.

Mitigation Strategies

Update Gitea to the latest version to ensure the fix for label deletion vulnerability is applied. Review repository and organization label permissions to ensure users have appropriate access levels.

Hi! I’m here to help you understand CVE-2026-97204. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70