Federated Learning (FL) enhances data privacy by enabling users to collaboratively train neural networks without sharing raw data. However, FL does not guarantee model privacy because clients share gradients of the model. This paper introduces a novel attack against FL in the regression setting, uncovering a previously unexplored vulnerability. We show that, in regression tasks where labels are continuous real numbers, gradient equations can be reduced to a hidden subset sum problem (HSSP, a cryptographic problem originally studied for integer values). By adapting cryptographic techniques for solving the HSSP, we demonstrate that labels can be accurately recovered, posing a significant privacy risk. Unlike analytical approaches for classification such as iDLG [22] that do not extend to regression, our method is specifically designed for this setting. Through extensive experiments on eight datasets with three different deep learning models, we demonstrate that label recovery achieves very low reconstruction error (e.g., MSE below 0.1 in some scenarios), significantly outperforming prior gradient inversion attacks such as DLG [23].