CVE-2026-58445

LowCVSS 2.7

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API.

An attacker can exploit this vulnerability to enumerate label IDs across repositories, potentially leading to information disclosure.

Update Gitea to a patched version and ensure the DeleteIssueLabel API checks repository access permissions.

Original NVD description (English source)

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API