CVE-2026-58445

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

CVE-2026-58445

The Gitea application is vulnerable to a cross-repository label-ID enumeration oracle . This issue is caused by the unscoped DeleteIssueLabel API , which allows an attacker to enumerate label IDs across different repositories. The vulnerability is addressed in Gitea version 1.27.0 . No specific e...

CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the DeleteIssueLabel function. An attacker can determine the existence of label IDs across repositories, including those they do not have access to, by observing differing HTTP respon...