Answer in brief
CVE-2026-118504 records a Unknown severity vulnerability in Gitea issue changes on archived repositories through the API. The current sources do not mark it as known exploited. The current feed maps Gitea/Gitea (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Gitea/Gitea (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Gitea/Giteageneric | >=0 <28.3.0 | 28.3.0 |
Published upstream
Nov 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 1, 2026
The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository is archived. A user allowed to change issues of an archived repository could use the API to edit, close or delete issues, change labels and deadlines, add or delete tracked time and stopwatches, add reactions, change issue blocks, and pin issues, altering data that archiving is meant to freeze. Gitea 28.2.0 added the check to the issue edit, delete and label routes; Gitea 28.3.0 applies it to all modifying repository API requests.
Quoted source text, attributed separately from HOL analysis.