Summary

DeleteLabel(ctx, id, labelID) takes one untyped id and compares it against the
label's org id or its repo id, depending on what kind of label it turns out to be.
Repository ids and organisation ids come from independent sequences and collide freely.
A user with issues-write on repository id N can therefore delete labels belonging to
organisation id N, a tenant they have no standing in.

Details

// models/issues/label.go:273-302 (v1.27.3)
func DeleteLabel(ctx context.Context, id, labelID int64) error {
	l, err := GetLabelByID(ctx, labelID)
	…
	return db.WithTx(ctx, func(ctx context.Context) error {
		if l.BelongsToOrg() && l.OrgID != id {
			return nil
		}
		if l.BelongsToRepo() && l.RepoID != id {
			return nil
		}

		if _, err = db.DeleteByID[Label](ctx, labelID); err != nil {
			…

Which test runs is chosen by the label's kind, not the caller's. The repo-scoped
handler passes ctx.Repo.Repository.ID; if labelID resolves to an org label, the
first branch compares that repository id against the label's organisation id. Equal
numbers pass the check and the delete goes ahead.

Callers: routers/api/v1/repo/label.go:271, routers/api/v1/org/label.go:252,
routers/web/repo/issue_label.go:157, routers/web/org/org_labels.go:88. The org-side
routes require reqOrgOwnership; the repo-side ones do not.

Impact

This deletes one tenant's labels from inside another tenant. Labels carry triage state,
so removing an organisation's labels detaches them from every issue in that org that
used them. The collision is not attacker-chosen. My run arranges one deliberately with
filler repositories on an empty instance; on a populated instance, forcing a specific
collision may well be impractical, though spotting an existing one is cheap since both
ids are visible through the API. I scored AC:H for that, and I have shown the missing
type check rather than a practical targeted attack.

CVE-2026-58445 (GHSA-pgqf-926r-548m) and CVE-2026-25038 fixed label scoping at or
below 1.27.0; this conflation survives both.

AI usage

I noticed DeleteLabel scopes on a single untyped id, read that function and its four
callers at v1.27.3, then ran the colliding-id fixture against both routes on a private
instance; the PoC block is its stdout. An LLM helped with the prose.