The DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id} API endpoint in Gitea performs a global, unscoped lookup of label IDs without verifying that the label belongs to the repository or organization in the URL. Because the HTTP response status differs based on whether the label ID exists anywhere on the instance (204 if exists, 422 if not), an authenticated user can use this endpoint as an oracle to enumerate label IDs across repositories and organizations they do not have access to. The deletion operation itself does not mutate data for foreign labels, preventing cross-repository writes or disclosure of label details. This issue affects all versions before 1.27.0 and no official patch is yet available.

An authenticated user with write:issue permission on their own repository can confirm the existence of arbitrary label IDs anywhere on the Gitea instance, including private repositories and organizations they cannot access. This results in an information disclosure vulnerability limited to label ID existence enumeration. No label names, colors, or repository ownership information are revealed, and no unauthorized data modification occurs.

No official patch is currently available. The recommended remediation is to scope the label lookup in the DeleteIssueLabel handler to the repository or organization of the URL, returning a 404 status for labels outside this scope. This change would prevent the endpoint from revealing label existence across tenant boundaries. Until a patch is released, users should be aware of this information disclosure risk and restrict access tokens with write:issue permissions accordingly.