The vulnerability in Gitea 1.26.2 allows users without authentication to retrieve labels of private organizations, revealing internal metadata about the organization. This omission of proper authorization checks manifests as a CWE‑200 information‑disclosure weakness combined with the absence of access control (CWE‑862).

The affected software is the Gitea Open Source Git Server, version 1.26.2. Users running this release are at risk until they upgrade to a patched version, such as 1.26.3 or later.

The attack vector is likely via the web interface or API endpoint that returns organization labels; no authentication is required to reach the endpoint. The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker could leverage unauthenticated requests to this endpoint to gather confidential information about a private organization.