CVE-2026-58445

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.4

Description An authenticated user can use a specific API endpoint as a cross-repository label-ID existence and enumeration oracle. This occurs because the system performs a global, unscoped lookup of labels by ID and fails to verify if the label belongs to the repository or organization specified in the request. While no label names, colors, or owning repositories are disclosed, and no unauthorized writes occur, an attacker can determine if a label ID exists anywhere on the instance based on the HTTP response status: a 204 No Content response indicates the label ID exists, while a 422 response indicates it does not. This allows for the enumeration of the instance-wide label population, including labels in private repositories and organizations the user cannot access.

API Endpoint: DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id} Vulnerable Parameter: id

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.