Gitea can send release notification emails for private repositories to users whose access has been revoked after a repository is changed from public to private. The notification may reveal release titles, tags, and content, causing a leakage of confidential release information. The vulnerability is assessed as a disclosure of private data (confidentiality impact).

The issue affects Gitea Open Source Git Server environments where a repository is made private after users have been granted watch access. The vulnerability applies to all versions of Gitea that had the described email notification behavior prior to the 1.25.4 release. No specific version range is identified beyond the pre‑1.25.4 builds.

The CVSS score of 3.5 classifies this as low severity, and the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an incidental disclosure: a user who had access to a public repository now receives release emails for a private repository after permission changes, revealing release details. Because no remote execution or authentication bypass is required, the risk is limited to information leakage, and no complex prerequisites are needed.