CVE-2026-25038

Gitea version 1.26.2 is vulnerable to an authorization bypass that allows unauthorized users to access labels of private organizations . The issue stems from a failure to properly enforce visibility restrictions on specific organization label read endpoints, specifically GET /api/v1/orgs/{org}/la...

CVE-2026-25038 Gitea private organization labels are visible to unauthorized users

Gitea 1.26.2 allows unauthorized users to access labels of private organizations...

PT-2026-55592

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description Unauthorized users can access labels associated with private organizations. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...