https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 06:12:16 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352869 EUVD-2026-352869 https://cve.radiocsirt.org/vuln/euvd-2026-352869 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58445 <p>Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API</p> <p>Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58445 https://cve.radiocsirt.org/vuln/ghsa-pgqf-926r-548m <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>The API endpoint `DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id}` loads the label by ID with a **global, unscoped** lookup and never verifies the label belongs to the URL&#39;s repository (or its owning organization). Because the response status differs by whether the label ID exists **anywhere on the instance** (204) versus not (422), an authenticated user can use the endpoint as a **cross-repository label-ID existence / enumeration oracle**, including for labels in repositories and organizations they cannot access.</p> <p>## Severity</p> <p>- The leaked information is minimal (existence/count of label IDs instance-wide); **no label name, color, or owning repository is disclosed, and no cross-repository write occurs.**</p> <p>## Affected / patched versions</p> <p>- **Affected:** through **1.26.3** (latest at time of report). - **Patched:** none yet.</p> <p>## Details</p> <p>`DeleteIssueLabel` resolves the label with a global loader and never checks its scope:</p> <p>```go // routers/api/v1/repo/issue_label.go (DeleteIssueLabel) label, err := issues_model.GetLabelByID(ctx, ctx.PathParamInt64(&#34;id&#34;)) // global, unscoped ```</p> <p>`GetLabelByID` (`models/issues/label.go`) is `e.ID(labelID).Get(l)` with **no** `repo_id` / `org_id` filter. The handler never verifies `label.RepoID == ctx.Repo.Repository.ID` (nor the org-label equivalent), and the downstream `issue_service.RemoveLabel` (`services/issue/label.go`) only re-checks the doer&#39;s write permission on the **issue&#39;s own** repository — never that the…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>The API endpoint `DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id}` loads the label by ID with a **global, unscoped** lookup and never verifies the label belongs to the URL&#39;s repository (or its owning organization). Because the response status differs by whether the label ID exists **anywhere on the instance** (204) versus not (422), an authenticated user can use the endpoint as a **cross-repository label-ID existence / enumeration oracle**, including for labels in repositories and organizations they cannot access.</p> <p>## Severity</p> <p>- The leaked information is minimal (existence/count of label IDs instance-wide); **no label name, color, or owning repository is disclosed, and no cross-repository write occurs.**</p> <p>## Affected / patched versions</p> <p>- **Affected:** through **1.26.3** (latest at time of report). - **Patched:** none yet.</p> <p>## Details</p> <p>`DeleteIssueLabel` resolves the label with a global loader and never checks its scope:</p> <p>```go // routers/api/v1/repo/issue_label.go (DeleteIssueLabel) label, err := issues_model.GetLabelByID(ctx, ctx.PathParamInt64(&#34;id&#34;)) // global, unscoped ```</p> <p>`GetLabelByID` (`models/issues/label.go`) is `e.ID(labelID).Get(l)` with **no** `repo_id` / `org_id` filter. The handler never verifies `label.RepoID == ctx.Repo.Repository.ID` (nor the org-label equivalent), and the downstream `issue_service.RemoveLabel` (`services/issue/label.go`) only re-checks the doer&#39;s write permission on the **issue&#39;s own** repository — never that the…</p> https://cve.radiocsirt.org/vuln/ghsa-pgqf-926r-548m https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304