The vulnerability results from the Gitea API failing to rebuild a team's per-unit permissions when only the permission field is updated. When an organization owner demotes a team from a higher level such as admin to read, the team’s members keep their existing unit permissions, including write access to the team’s repositories. This flaw allows users who should no longer have elevated rights to continue modifying code in the repositories controlled by the team. The weakness is identified as CWE-272, a weak access control issue.

The issue affects all Gitea installations running versions older than 28.0.0, as the 28.0.0 release contains the logic to rebuild permissions correctly. Systems updated to 28.0.0 or newer are not vulnerable, whereas those that remain on older releases are at risk.

The CVSS score of 8.1 indicates a high severity, but the EPSS score of less than 1% suggests that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated API call that modifies a team's permission level; an organization owner or administrator can perform this operation. The flaw requires no additional user interaction beyond this API request, so insiders or compromised administrative credentials can abuse the bug to maintain unauthorized write access.