Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.27.0 | 1.27.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the DeleteIssueLabel function, which is responsible for handling the DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id} API endpoint. The function uses issues_model.GetLabelByID to retrieve the label. This lookup is global and does not check if the label belongs to the repository specified in the URL. This allows an attacker to use this endpoint as an oracle to check for the existence of any label ID on the instance, by observing the difference in HTTP status codes (204 for existing, 422 for non-existing). The fix, identified in commit de4b8277e9cb576f2315fb03b5ab6478b42a1d31, introduces a new scoped lookup function GetLabelInRepoOrOrgByID and modifies DeleteIssueLabel to use it, thus ensuring that the label is validated against the repository's scope. The vulnerable functions are DeleteIssueLabel and the underlying unscoped GetLabelByID.
DeleteIssueLabelrouters/api/v1/repo/issue_label.go
GetLabelByIDmodels/issues/label.go