Description
Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Gitea | Gitea | ≤ 28.1.0 | — |
Advisories 1
- WID-SEC-2026-4021 Gitea: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
References
- GitHub Security Advisory GHSA-fxq4-gr55-7x5g vendor-advisory
- Fix: go-gitea/gitea pull request #39743 patch
- Fix backport to release/v28: go-gitea/gitea pull request #39752 patch
- Gitea 28.2.0 release announcement release-notes
- go-gitea/gitea v28.2.0 release release-notes