# CVE-2026-118504: Gitea REST API archived repository modification bypass

Source: https://junglewise.ai/threats/cve-2026-118504-the-web-interface-blocks-issue-and-pull-request-changes-on  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-118504 · Severity: info · Published 2026-11-01

Gitea, a self-hosted Git service that teams use to manage code repositories, failed to enforce archival protections on its REST API. Users could use the API to modify issues, pull requests, labels, and other metadata in archived repositories, even though the web interface blocks such changes. This allows attackers to alter project data that archiving is intended to protect from accidental or unauthorized changes.

Technologies: [Gitea](https://junglewise.ai/threats/technologies/gitea). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea).

## Quick answers

**Is CVE-2026-118504 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118504 being exploited in the wild.

**How severe is CVE-2026-118504?** Informational severity, published 1 November 2026.

**Which products and versions are affected?** Gitea before 28.2.0.

**Is there a fix for CVE-2026-118504?** Yes: fixed in Gitea 28.2.0, 28.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118504 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-118504?** Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Gitea 28.2.0, 28.3.0

## Technical details

The web UI enforced a check preventing modifications to archived repositories, but the REST API issue and comment routes lacked this validation, allowing authenticated users with repository write access to edit, delete, or create issues; modify labels, milestones, and tracked time; and add reactions via API calls. An attacker needs write access to the repository and knowledge of the API endpoints. The fix adds archive checks to all modifying API requests across Gitea 28.2.0 and 28.3.0 releases.

## Affected products

- Gitea Gitea before 28.2.0

## Timeline

- 2026-11-01: disclosed
- 2026-11-01: patched

## References

- [https://blog.gitea.com/release-of-28.3.0/](https://blog.gitea.com/release-of-28.3.0/)
- [https://github.com/go-gitea/gitea/pull/39839](https://github.com/go-gitea/gitea/pull/39839)

## Related threats

- [Gitea account takeover via OAuth2 auto-linking](https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the)
- [Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and)
- [Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http)
- [Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull)
- [Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an)