CVE-2026-58445

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

CVE-2026-58445

CVE-2026-58445 corresponds to a Gitea vulnerability: the unscoped DeleteIssueLabel API loads a label by global ID without verifying repository/org scope, enabling a cross-repository label-ID existence/enumeration oracle. This can reveal whether arbitrary label IDs exist across the instance (inclu...

CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the DeleteIssueLabel function. An attacker can determine the existence of label IDs across repositories, including those they do not have access to, by observing differing HTTP respon...