Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

Affected: Go: code.gitea.io/gitea

## Summary

Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints.

A user without access to a private organization can retrieve labels belonging to that organization through the Organization Labels API. As a result, label metadata intended to be restricted to organization members may be disclosed.

The issue is limited to unauthorized read access. No unauthorized modification of labels was observed.

## Details

The following endpoints are affected:

* `GET /api/v1/orgs/{org}/labels` * `GET /api/v1/orgs/{org}/labels/{id}`

During testing, a private organization was created and a label was added to that organization.

Access to the organization itself was correctly restricted. A user without membership in the organization received a `404 Not Found` response when requesting organization information.

However, the same user was still able to retrieve organization labels through the endpoints listed above.

For comparison, other organization-scoped endpoints such as:

* `GET /api/v1/orgs/{org}/teams` * `GET /api/v1/orgs/{org}/hooks` * `GET /api/v1/orgs/{org}/actions/secrets`

correctly denied access to unauthorized users.

The label endpoints returned the full Label object, including fields such as:

* `id` * `name` * `description` * `color` * `url`

Write operations were tested separately and remained protected by authorization checks.

## PoC

### Setup

Create a private organization:

```http POST /api/v1/orgs Author…

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.