The vulnerability in Gitea's DeleteIssueLabel API endpoint arises because label IDs are looked up globally without verifying repository scope. An authenticated user with write:issue permission on their own repository can use this flaw to determine whether specific label IDs exist anywhere on the Gitea instance, including in private repositories they do not have access to. The vulnerability only allows existence enumeration of label IDs; it does not disclose label names or allow cross-repository label modifications. This issue affects all versions prior to 1.27.0. A patch is available to address this vulnerability.

An authenticated user with write:issue permission on their own repository can enumerate the existence of label IDs across all repositories on the Gitea instance, including private repositories they cannot access. This information disclosure is limited to label ID existence and does not reveal label names or allow unauthorized modification of labels. The impact is therefore limited to low-severity information disclosure.

A patch is available for this vulnerability. Users should upgrade to Gitea version 1.27.0 or later to remediate this issue. Until patched, users should be aware that authenticated users with write:issue permissions can enumerate label IDs globally.