Executive brief
Gitea is a self-hosted software development platform similar to GitHub. A security flaw allowed unauthorized users to view labels belonging to private organizations, even if they were not members of those organizations. While attackers could not modify any data, they could see internal label names and descriptions, which might reveal sensitive project details or organizational workflows.
Technical details
An information disclosure vulnerability exists in Gitea versions prior to 1.26.3 due to missing authorization checks in the organization label read endpoints. Specifically, the 'GET /api/v1/orgs/{org}/labels' and 'GET /api/v1/orgs/{org}/labels/{id}' endpoints do not verify if the requesting user has access to the private organization, whereas other organization-scoped endpoints correctly return a 404 error. An unauthenticated or unauthorized attacker can exploit this to retrieve full Label objects, including names, descriptions, and colors. This issue is limited to read access; write operations remain protected. The vulnerability is addressed in version 1.26.3.
Affected products
- Gitea Gitea < 1.26.3
Timeline
- 2026-06-21: disclosed
- 2026-07-03: advisory: NVD publication date
- 2026-07-21: advisory: GitHub Advisory published
- 2026-06-21: patched: Version 1.26.3 released