Description

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-13T17:17:28.543Z",
  "pubdate": "2026-08-13T17:17:28.543Z",
  "executiveSummary": "A cross-repository label-ID enumeration oracle vulnerability exists within the DeleteIssueLabel API due to the use of unscoped identifiers. This flaw allows unauthorized actors to determine the existence and validity of label IDs across different repositories by observing differing error responses or status codes returned by the vulnerable endpoint. The vulnerability directly impacts data confidentiality by enabling systematic metadata reconnaissance, which can be leveraged to map internal repository structures and sensitive categorization schemes. The risk implication centers on information disclosure, potentially facilitating subsequent, more targeted attacks against the affected platform. Attackers require network access to the API endpoint and the ability to issue programmatic requests to interact with the enumeration oracle. Exploitation prerequisites are minimal, relying primarily on the application's failure to enforce strict tenant or repository isolation within the DeleteIssueLabel function scope during ID validation and deletion processing.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of proper scoping and authorization boundaries enforced by the DeleteIssueLabel API. When a request is processed to delete a label by its identifier, the underlying backend logic fails to validate whether the targeted label ID belongs to the specific repository context provided in the user's session or API request parameters. Instead, the function performs a global or insufficiently scoped lookup against the database or data store.\nThe exploitation method relies on differential response analysis, commonly referred to as an oracle attack. An attacker initiates HTTP requests to the DeleteIssueLabel endpoint using sequential or brute-forced label IDs coupled with a target repository context where the attacker possesses valid access. Because the backend lookup processes IDs without proper repository-boundary checks, the API yields distinct responses—such as differing HTTP status codes (e.g., 404 Not Found versus 403 Forbidden or 200 OK)—depending on whether the label ID exists anywhere in the system, rather than strictly within the authorized repository.\nThe attack flow proceeds as follows: First, the attacker identifies the DeleteIssueLabel API route and captures a legitimate request transaction. Second, the attacker script iterates through a range of label IDs, keeping the repository identifier constant while varying the target label parameter. Third, the attacker logs the differential responses returned by the vulnerable component. By analyzing these response discrepancies, the attacker successfully enumerates valid label IDs belonging to other isolated repositories, thereby bypassing intended multi-tenancy and access control isolation mechanisms."
}