The vulnerability allows a signed‑in user who can read a locked issue or comment to add or remove reactions on that content, bypassing the intended lock restriction. Reactions are the only activity permitted by the lock, so this bug does not allow content modification, code execution, or data exfiltration, but it does undermine the issue‑locking feature and can cause confusion or nuisance for users.

The flaw affects all versions of Gitea released before 28.2.0. Version 28.2.0 contains a fix that denies reaction changes on locked issues for users lacking write access, restoring the intended lock behavior.

Because the bug requires only a normal authenticated account and no special privileges, exploitation is straightforward via the web UI or API. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation activity. While the impact does not involve data compromise, the ability to circumvent the lock can degrade operational integrity and user trust. Organizations should consider the fix promptly, as the risk of abuse increases if the lock feature is relied upon for critical issue workflows.