The Gitea Open Source Git Server release 1.26.2 permits any visitor of the web interface or API to retrieve the labels attached to private organizations. As a result the server discloses internal metadata of the organization, a behavior that violates the expectation that private data remains hidden from unauthenticated users. The weakness is rooted in a missing access‑control check, which is reflected as CWE‑200 Information Exposure and CWE‑862 Missing Authorization.

The vulnerable version is Gitea Open Source Git Server 1.26.2. Administrators maintaining a server running this release are impacted until an upgrade to 1.26.3 or any later patched build is performed.

The defect can be exploited by sending unauthenticated requests to the endpoint that, either through the web UI or the REST API. The CVSS score of 7.5 signals a high severity level, but the EPSS value of less than 1 % indicates that at present the likelihood of exploitation is low. The vulnerability is not listed in the CISA Key Exploited Vulnerabilities catalog. An attacker who successfully triggers the endpoint can gain visibility into private organization structure and potentially leverage that information for further reconnaissance.