CVE-2026-97204 | BDVDB-2026-390761 Detail

Description#

Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-18Record published in the CVE List.
2. Version 22026-10-19Most recent update recorded in the CVE List.