The vulnerability allows a user who can open a pull request from a fork to cancel trusted in‑progress Gitea Actions runs that share a concurrency group without approval. This cancellation can interrupt self‑hosted deployments and leave partial state behind. The flaw originates from an improper check of the new run’s approval status before canceling older runs, which results in an unauthorized cancellation operation. The primary weakness is an absence of proper access control.

The affected product is Gitea, version information is not explicitly provided in the CVE. The fix appears in the 28.0.0 release. Users running older Gitea versions are vulnerable if they allow forks to create pull requests and enable the `cancel‑in‑progress` setting on workflows.

The vulnerability has a CVSS score of 7.5 and an EPSS score of < 1%, indicating moderate to high severity but low likelihood of exploitation. The potential to disrupt critical self-hosted deployments suggests a moderate to high risk of availability impact. Because the attack vector requires only the ability to open a fork-based pull request, an attacker with even limited collaborator access can exploit it. Governance of fork permissions and prompt version upgrades are recommended to mitigate this risk.