Is CVE-2026-97204 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97204 being exploited in the wild.

How severe is CVE-2026-97204?

Informational severity, published 18 October 2026.

Is there a fix for CVE-2026-97204?

Yes: fixed in Gitea 28.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97204 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-97204?

Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97204: Gitea label deletion authorization bypass in repository

CVE-2026-97204 · Severity: info · Published 2026-10-18

Gitea is a lightweight Git service that powers collaboration in repositories and organizations. A repository maintainer with write access to issues could delete labels belonging to any organization that happens to have the same numeric ID as their repository, due to insufficient authorization checks. This could disrupt workflow management and label-based issue organization for targeted organizations.

Technologies: Gitea. Vendors: Gitea.

Quick answers

Is CVE-2026-97204 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97204 being exploited in the wild.
How severe is CVE-2026-97204?: Informational severity, published 18 October 2026.
Which products and versions are affected?: Gitea before 28.2.0.
Is there a fix for CVE-2026-97204?: Yes: fixed in Gitea 28.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97204 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-97204?: Check whether you run Gitea at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Gitea 28.2.0

Technical details

The vulnerability exists in the label deletion logic, which compared repository IDs against organization IDs without type distinction, allowing deletion across scope boundaries when numeric IDs overlap. An authenticated user with write access to a repository's issues can exploit this by making a delete request with a specially crafted label ID. The fix restricts label deletion to only those labels owned by the requester's repository or organization context.

Affected products

Gitea Gitea before 28.2.0

Timeline

2026-10-18: disclosed
2026-10-12: patched: Fixed in PR #39743/#39752

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.