CVE-2026-116296: Gitea archived repository protection bypass

CVE-2026-116296 affects Gitea API routes for releases, release assets, milestones and labels. The vulnerability allows users with write access to archived repositories (or holders of write-scoped tokens) to replace or delete release assets, remove releases and tags, and create, modify or delete milestones and labels—operations that should be forbidden on read-only archived repositories. This access control bypass undermines the integrity of archived project data.

CVSS score is not yet published. The vulnerability was disclosed on November 1, 2026, as part of coordinated release. Public signals on GitHub confirm descriptions linking CVE-2026-116296 to Gitea's protection bypass on archived repositories. This is a direct authorization bypass that circumvents access controls meant to protect read-only repositories.

IT teams must update Gitea immediately. The fix modifies API routes to return HTTP 423 Locked for archived repositories, blocking write operations. Check your current Gitea version and review official release notes to identify the patched release. For environments with critical archived repositories, prioritize this update in your patch management queue.