Cross-Repository Label-ID Enumeration Vulnerability in Gitea by Gitea
CVE-2026-58445

2.7LOW

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-58445?

The vulnerability allows attackers to exploit the unscoped DeleteIssueLabel API, potentially enabling cross-repository label-ID enumeration. This weakness could be leveraged to obtain sensitive information about labels associated with issues across different repositories.

Affected Version(s)

Gitea Open Source Git Server 0 <= 1.26.4

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/
release-notes

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CassianStarck
.