The vulnerability is a cross‑site request forgery that allowed a third‑party site to trigger a POST request to the /{owner}/{repo}/topics endpoint without proper sign‑in or cross‑origin protection. Consequently, a repository administrator who was logged in could have the topics of their repository silently altered by an attacker’s malicious page. The change merely affects the repository metadata and does not grant any other administrative or code‑execution capabilities.

The flaw exists in Gitea, version at or before 28.2.0. The specific route /{owner}/{repo}/topics was unprotected in older releases, but the 28.2.0 security patch removes the vulnerability. Administrators using Gitea installations older than 28.2.0 are potentially impacted.

Without a CSRF token check or sign‑in middleware, the exploit relies on an authenticated user’s browser requesting the vulnerable endpoint from a malicious origin. An attacker can craft a benign webpage that triggers the change while the administrator mouses over or simply visits the page. The CVSS score is not reported, so the official severity is unclear; however, the EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. The risk is moderate because the attacker’s success requires the target user to be authenticated, and the impact is limited to topic metadata, yet the scenario remains significant for repositories that rely on precise topic labels for visibility or automation.