A flaw in the DeleteIssueLabel API allows an attacker to query whether a specific label ID exists across repositories without requiring elevated privileges. The API does not apply scoping rules, enabling cross-repository enumeration. This leads to disclosure of internal identifier information and an attacker can map the repository issue labeling schema, which may aid in planning subsequent attacks. The weakness is aligned with CWE-203 (Information Exposure) and CWE-639 (Privilege? ), indicating sensitive data is exposed through an insufficient access control check.

The vulnerability is present in the Gitea Open Source Git Server, a popular Git hosting platform. No specific version list is provided, but the advisory references a software release that presumably contains a fix. Any installation of Gitea that has not applied the security patch would be susceptible.

Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the exploitation probability appears to be low to moderate. The attack surface is limited to users who can interact with the DeleteIssueLabel endpoint, which may be reachable without authentication in some configurations. Attackers could easily enumerate label IDs once they can call the API, but the enum operation itself does not grant further privileges. Organizations should still consider the potential for attackers to use discovered identifiers to craft targeted phishing or social engineering attacks.