{"id":"CVE-2026-116296","kind":"vulnerability","aliases":["CVE-2026-116296"],"related":[],"title":"Forge API let writers change archived repositories' releases and labels","description":"The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download URLs, delete releases and tags, and create, edit or delete milestones and labels of a repository that is meant to be read-only. Changing requests on these routes now return 423 Locked for archived repositories.","summary":"The API routes for releases, release assets, milestones and repository labels accepted changes to archived, read-only repositories. A user with write access, or a write-scoped token holder, could replace release assets, delete releases and tags, and edit milestones and labels.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api","git-forge","other","self-hosted"],"not_affected_if":["no-archived-repositories","read-only-tokens"],"how_to_check":null,"fix":"- Changing requests on these routes now return 423 Locked for archived repositories; the sources do not name the fixed version.","status":"open","published_at":"2026-11-01T10:18:35+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","triaged_at":"2026-11-01T10:51:37+00:00","updated_at":"2026-11-01T10:51:37+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-01T10:51:37Z","model":"claude-haiku-5-5","output":{"fix":"- Changing requests on these routes now return 423 Locked for archived repositories; the sources do not name the fixed version.","reach":"network","title":"Forge API let writers change archived repositories' releases and labels","impact":"medium","summary":"The API routes for releases, release assets, milestones and repository labels accepted changes to archived, read-only repositories. A user with write access, or a write-scoped token holder, could replace release assets, delete releases and tags, and edit milestones and labels.","audience":"businesses","category":"other","nicknames":[],"who_cares":["self-hosted","git-forge","api"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Release assets replaced and releases or tags deleted in archived repositories","analyst_note":"Identify the affected product and fixed versions from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-116296); the sources do not name them.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-archived-repositories","read-only-tokens"],"who_is_affected":"Teams that host repositories on a self-hosted Git forge and archive repositories to freeze them. The flaw concerns the API for releases, release assets, milestones and labels on archived repositories; exposure depends on users or tokens with write access to those repositories. Teams that do not use archived repositories on this forge, or that only use the web UI, can deprioritise it; the sources do not say which product or versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4150,"output_tokens":560,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116296':13A,16A '-2026':12A,15A '423':149C 'accept':36B 'access':48B,91C 'api':2A,17B,26B,70C 'archiv':6A,39B,85C,94C,152C 'asset':31B,59B,75C,113C 'chang':5A,37B,83C,142C 'could':56B,108C 'creat':124C 'cve':11A,14A 'delet':60B,111C,119C,127C 'download':117C 'edit':65B,125C 'forg':1A,20B 'git':19B 'git-forg':18B 'holder':55B,98C 'host':24B 'keep':115C 'label':10A,35B,68B,79C,130C 'let':3A 'lock':150C 'meant':136C 'mileston':32B,66B,76C,128C 'read':41B,140C 'read-on':40B,139C 'reject':82C 'releas':8A,29B,30B,58B,61B,73C,74C,112C,120C 'replac':57B,109C 'repositori':7A,34B,43B,78C,86C,95C,133C,153C 'request':143C 'return':148C 'rout':27B,71C,146C 'scope':53B,106C 'self':23B 'self-host':22B 'tag':63B,122C 'token':54B,107C 'url':118C 'user':45B,88C,102C 'write':47B,52B,90C,105C 'write-scop':51B,104C 'writer':4A","nicknames":[],"mitigations":[],"who_affected":"Teams that host repositories on a self-hosted Git forge and archive repositories to freeze them. The flaw concerns the API for releases, release assets, milestones and labels on archived repositories; exposure depends on users or tokens with write access to those repositories. Teams that do not use archived repositories on this forge, or that only use the web UI, can deprioritise it; the sources do not say which product or versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T10:18:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116296","severity":null,"published_at":"2026-11-01T10:18:35+00:00","modified_at":"2026-11-01T10:18:35+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","fetched_at":"2026-11-01T10:49:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}