Gitea EUVD-2026-41621

Exploitation requires only that a private organization exists with labels defined and that the attacker can reach the Gitea REST API at GET /api/v1/orgs/{org}/labels or GET /api/v1/orgs/{org}/labels/{id}. The vendor PoC used an authenticated non-member token (an ordinary account lacking membership in the target org), so at minimum a valid API token appears sufficient; the CVSS PR:N claims no authentication, but this was not demonstrated anonymously in the provided evidence, so fully unauthenticated access is unconfirmed. Limiting factors: the target org must be private and actually have labels; only label metadata is exposed (no repos, secrets, teams, or write access); and impact is confined to information disclosure. No user interaction is required.

Signals are mixed and lean toward low real-world urgency despite the 7.5 'High' base score. The NVD vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) drives severity through C:H, but the leaked data is only label metadata (names, colors, descriptions) - treating that as 'High' confidentiality impact appears overrated; a Low confidentiality impact is more defensible, which would materially reduce the score. EPSS is low (0.20%) and the vulnerability is NOT on CISA KEV, so no active exploitation is indicated. SSVC lists Exploitation=PoC, Automatable=Yes, Technical Impact=Partial, which is consistent: a working PoC exists and the request is trivially scriptable, but the impact is partial (read-only metadata leak, no code execution or write access). Note a discrepancy: the CVSS vector states PR:N (unauthenticated), yet the vendor PoC demonstrates the attack using an authenticated non-member token, so whether fully anonymous access works is not confirmed from the provided data - verify with the vendor. Net: a legitimate hygiene fix, not an emergency.

An attacker with a low-privilege Gitea account (a valid token but no membership in the target org) sends GET /api/v1/orgs/target-org/labels and receives HTTP 200 with the full label list of a private organization, despite GET /api/v1/orgs/target-org returning 404. The disclosed label names and descriptions can reveal internal project structure, teams, or workflow taxonomy useful for reconnaissance. A working PoC is published in the vendor advisory and the request is trivially automatable (SSVC Automatable=Yes).