Auth bypass in Gitea

CVE-2026-116296

The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download URLs, delete releases and tags, and create, edit or delete milestones and labels of a repository that is meant to be read-only. Changing requests on these routes now return 423 Locked for archived repositories.

Vulnerability class: Broken Access Control

Published · last modified .

EPSS exploit prediction

EPSS: 0.002 (9.6th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 9.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2026-116296?
CVE-2026-116296 is a vulnerability in Gitea, classified under Missing Authorization. Published 2026-11-01.
Is CVE-2026-116296 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.