Gitea EUVD-2026-103992

Two concrete prerequisites must both hold: (1) the attacker must be an authenticated Gitea user with write access to the issues of some repository (PR:L), and (2) there must exist an organization whose numeric ID equals that repository's numeric ID - the ID sequences for repositories and organizations overlap, but a usable collision is coincidental and cannot be freely chosen by the attacker, which is the core limiting factor and the basis for AC:H. Impact is limited to deletion of that organization's issue labels (integrity only); no confidentiality or availability of other data is affected. Only Gitea instances at or below version 28.1.0 are vulnerable; fixed in 28.2.0.

All available signals converge on this being a genuinely LOW priority. The supplied CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N yields a 3.1 (Low) score driven by integrity-only impact (I:L), required low privileges (PR:L) and high attack complexity (AC:H). EPSS reinforces this at 0.15% (4th percentile), and CISA's SSVC decision framework independently agrees: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis. CWE-863 (Incorrect Authorization) matches the description - this is a cross-tenant authorization flaw, not an authentication bypass. The AC:H rating is well-justified: exploitation depends on a coincidental collision where an organization's numeric ID equals the attacker's repository ID, which the attacker cannot freely engineer. No signals conflict; the only data-quality concern is the 'Authentication Bypass' tag, which mischaracterizes an authorization/IDOR-class issue. Bottom line: a real but low-severity bug, appropriately patched, not warranting emergency action.

A user holding write access to a repository's issues notices that some organization happens to share the same numeric ID as their repository. When they invoke the label-deletion API/endpoint, the flawed ID comparison matches the repo ID against the organization's label owner ID and deletes that organization's labels instead of (or in addition to) their own. No public exploit code exists, and the network-reachable but high-complexity nature (AV:N/AC:H) means success hinges on the rare ID overlap.