What is the CVSS score of CVE-2026-25038?

CVE-2026-25038 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Gitea are affected by CVE-2026-25038?

Gitea 1.26.2 contains a vulnerability allowing unauthorized users to access metadata about private organization labels, potentially exposing sensitive organizational structures and classification…. A patch is available.

How to fix or mitigate CVE-2026-25038?

Within 24 hours, identify all Gitea 1.26.2 instances in production and obtain the latest vendor-released patch. Within 7 days, deploy the patch to all affected instances and verify that the Organization Labels API endpoints now correctly restrict access to authorized members only through functional testing. Within 30 days, conduct a security audit of access logs to identify any unauthorized label metadata requests and document findings for incident response records.

Gitea CVE-2026-25038

EUVD-2026-41621 HIGH

Information Exposure (CWE-200)

2026-07-03 Gitea

GHSA-v73x-hx65-6pf4

Information Disclosure Gitea Gitea Open Source Git Server Suse

7.5

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network API reachable and trivial (AV:N/AC:L); PoC required a non-member token so PR:L; only low-sensitivity label metadata leaks so C:L, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 18:35 vuln.today

Analysis Generated

Jul 22, 2026 - 18:35 vuln.today

CVE Published

Jul 03, 2026 - 20:19 cve.org

HIGH 7.5

CVE Published

Jul 03, 2026 - 20:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

AnalysisAI

Information disclosure in the Gitea 1.26.2 self-hosted Git service allows non-members to read the labels of private organizations via the Organization Labels API, exposing label metadata (id, name, description, color, url) that should be restricted to org members. The authorization gap affects GET /api/v1/orgs/{org}/labels and .../labels/{id} only, while organization info, teams, hooks, and secrets endpoints correctly returned 404 to the same user. Publicly available exploit code exists in the vendor GHSA advisory, though EPSS risk is low (0.20%, 10th percentile) and it is not on CISA KEV.

Technical ContextAI

Gitea is a lightweight, self-hosted Git service written in Go (package code.gitea.io/gitea), functionally similar to GitHub/GitLab. The root cause is CWE-200 (Exposure of Sensitive Information): the REST API label endpoints did not enforce the organization's visibility restriction before returning data. Per the fix in PR #38151, the router previously guarded org endpoints with reqTeamMembership() but the label routes lacked an equivalent visibility check; the patch introduces reqOrgVisible(), which calls organization.HasOrgOrUserVisible() so that a private org invisible to the doer yields a 404 (APIErrorNotFound) instead of leaking label objects. Only read access was affected - write/PATCH operations remained protected by existing authorization checks.

RemediationAI

Vendor-released patch: upgrade to Gitea 1.26.3 (or later, e.g. 1.26.4) - release at https://github.com/go-gitea/gitea/releases/tag/v1.26.3 and release notes at https://blog.gitea.com/release-of-1.26.3-and-1.26.4/; the fix is in PR https://github.com/go-gitea/gitea/pull/38151 and commit 99f8b3d9a1d32f4c39828e07971455a18191e0b9, which adds an organization-visibility check (reqOrgVisible) to the label API routes. If immediate upgrade is not possible, the practical compensating control is to restrict network access to the /api/v1/orgs/*/labels endpoints at a reverse proxy or WAF (deny requests from non-members/anonymous clients), accepting the trade-off that legitimate API label reads may also be blocked; there is no in-app configuration toggle that disables only the label endpoints, so patching is strongly preferred over workarounds. Consult GHSA-v73x-hx65-6pf4 for authoritative guidance.