CVE-2026-118504

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 28.3.0

Description Several issue routes of the REST API do not verify if a repository is archived. While the web interface prevents changes to issues and pull requests in archived repositories, an authorized user can bypass these restrictions via the API to edit, close, or delete issues, modify labels and deadlines, manage tracked time and stopwatches, add reactions, change issue blocks, and pin issues. This allows the alteration of data that is intended to be frozen by the archiving process.

Recommendations Update to version 28.3.0 or later to ensure all modifying repository API requests are checked for archived status.