Explained, a Gitea route that deletes tags required only write access to code but was shared with release deletion. Because the handler did not confirm the target was a tag, a collaborator with code write permission could delete published releases and their files, causing permanent loss of release data. The flaw constitutes an integrity violation, allowing an attacker to tamper with repository artifacts.

Gitea is the affected product. No specific version ranges are provided in the CNA data, so any instance of Gitea using the vulnerable tag‑deletion route may be impacted.

The vulnerability is exploitable via the web interface by any user with code write rights, without needing release‑level permissions. The CVSS score is 8.1, the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. Risk assessment is based on the potential for permanent data loss. The attack vector is local to the repository, but any collaborator can trigger it, making it a low‑barrier issue for accounts with write access.