A flaw in Gitea’s label‑deletion logic compared the numeric identifier of a repository with that of an organization when determining which labels to remove. Because the two ID sequences can overlap, a user who has write permissions on a repository’s issues could trigger the deletion of labels belonging to an organization that shares the same numeric ID. The consequence is loss of organization‑wide labeling, which can disrupt issue tracking, visibility, and downstream automation. This represents an authorization bypass (CWE‑863) that allows an unintended privilege escalation to delete resources outside the user’s intended scope.

The vulnerability affects Gitea installations running any version prior to 28.2.0. The product is the Gitea server component. No specific sub‑versions are listed beyond the pre‑patch threshold, so all releases before v28.2.0 are considered vulnerable unless other mitigations are applied.

The CVSS score is not disclosed in the advisory; however, the absence of a higher‑level control allows a local or remote attacker with repository‑write access to delete organization labels, which could impair operations. EPSS data is unavailable, so the likelihood of exploitation is uncertain. The issue is not listed in the CISA KEV catalog, suggesting no public exploits have been observed, but the control flaw remains serious. Attackers would likely use a crafted HTTP request to the label‑deletion endpoint, leveraging existing repository write permissions to exploit the ID comparison bug.