Live › vulnerability › CVE-2026-116296
The API routes for releases, release assets, milestones and repository labels accepted changes to archived, read-only repositories. A user with write access, or a write-scoped token holder, could replace release assets, delete releases and tags, and edit milestones and labels.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 10:49 UTC. All times on this page are UTC.
Teams that host repositories on a self-hosted Git forge and archive repositories to freeze them. The flaw concerns the API for releases, release assets, milestones and labels on archived repositories; exposure depends on users or tokens with write access to those repositories. Teams that do not use archived repositories on this forge, or that only use the web UI, can deprioritise it; the sources do not say which product or versions are affected.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download URLs, delete releases and tags, and create, edit or delete milestones and labels of a repository that is meant to be read-only. Changing requests on these routes now return 423 Locked for archived repositories.
This page as .md · .json · in your agent: get_signal("CVE-2026-116296")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.