A vulnerability exists in Gitea where the POST endpoint /{owner}/{repo}/topics can be accessed without the sign‑in middleware that normally supplies cross‑origin protection. This omission means a request sent from a third‑party origin is not rejected. If a repository administrator is logged in and visits a malicious page that issues a POST to the vulnerable endpoint, the topics of the administrator’s repository can be altered. No other settings or administrative functions are reachable through this route, so the impact is limited to repository metadata.

The flaw affects installations of Gitea that have not implemented the sign‑in middleware on the topics endpoint. The input data does not specify which releases contain the fix, so any Gitea deployment potentially lacking this protection is at risk.

The core weakness is a missing CSRF token check, marked by CWE-352, which allows an attacker to exploit a legitimate user’s authenticated session. The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests that exploit attempts are relatively rare. The vulnerability is not listed in CISA’s KEV catalog. The attack requires an administrator to visit a malicious web page; thus the overall risk is moderate, with potential disruption in repository visibility and automation that rely on topic labels.