CVE-2026-58445 - Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

LOW

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Published Aug 13, 2026

2.7

LOW

CVSS 3.1

EPSS 0.37%

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
0	affected	<=1.26.4

Ecosystem	Package	Introduced	Fixed
Go	code.gitea.io/gitea	0	1.27.0
Go	gitea.dev	0	1.27.0

No remediation recorded yet.

Weaknesses (2)

CWE-203

CWE-639

Authorization Bypass

Link	Providers	Tags
https://blog.gitea.com/gitea-1.27.0-is-released/		release-notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58172		Advisory
https://github.com/advisories/GHSA-pgqf-926r-548m		Advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0		release-notes
https://github.com/go-gitea/gitea/security/advisories/GHSA-pgqf-926r-548m		exploitvendor-advisory