CVE-2026-25038

Gitea version 1.26.2 is vulnerable to an unauthorized read access issue where users without membership in a private organization can retrieve label metadata. The vulnerability exists in the Organization Labels API at the following endpoints: GET /api/v1/orgs/{org}/labels and GET /api/v1/orgs/{org...

CVE-2026-25038 Gitea private organization labels are visible to unauthorized users

Gitea 1.26.2 allows unauthorized users to access labels of private organizations...

PT-2026-55592

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description Unauthorized users can access labels associated with private organizations. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...