Is CVE-2026-118504 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118504 being exploited in the wild.

How severe is CVE-2026-118504?

Informational severity, published 1 November 2026.

Is there a fix for CVE-2026-118504?

Yes: fixed in Gitea 28.2.0, 28.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118504 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-118504?

Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118504: Gitea REST API archived repository modification bypass

CVE-2026-118504 · Severity: info · Published 2026-11-01

Gitea, a self-hosted Git service that teams use to manage code repositories, failed to enforce archival protections on its REST API. Users could use the API to modify issues, pull requests, labels, and other metadata in archived repositories, even though the web interface blocks such changes. This allows attackers to alter project data that archiving is intended to protect from accidental or unauthorized changes.

Technologies: Gitea. Vendors: Gitea.

Quick answers

Is CVE-2026-118504 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118504 being exploited in the wild.
How severe is CVE-2026-118504?: Informational severity, published 1 November 2026.
Which products and versions are affected?: Gitea before 28.2.0.
Is there a fix for CVE-2026-118504?: Yes: fixed in Gitea 28.2.0, 28.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118504 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-118504?: Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Gitea 28.2.0, 28.3.0

Technical details

The web UI enforced a check preventing modifications to archived repositories, but the REST API issue and comment routes lacked this validation, allowing authenticated users with repository write access to edit, delete, or create issues; modify labels, milestones, and tracked time; and add reactions via API calls. An attacker needs write access to the repository and knowledge of the API endpoints. The fix adds archive checks to all modifying API requests across Gitea 28.2.0 and 28.3.0 releases.

Affected products

Gitea Gitea before 28.2.0

Timeline

2026-11-01: disclosed
2026-11-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.