The vulnerability in Gitea allows a signed‑in user who can read a locked issue or comment to add or remove reactions through the web UI or the API, even though the content is locked. The web handlers that process reaction changes do not check the lock status for users without write access, while the API correctly enforces the restriction; the mismatch enables reactions on locked items. Because the flaw only affects reactions, it does not permit modification of issue content, comments, repository files, or provide any code execution or data exfiltration capability. It mainly undermines the integrity of the lock feature, potentially causing confusion or misuse of lock status.

Based on the release notes and the fact that the fix was introduced in Gitea version 28.2.0, all deployments running a version older than 28.2.0 are likely affected, whereas instances on 28.2.0 or later are considered fixed.

The CVSS score of 4.3 indicates a moderate severity primarily because the exploit requires only a normal authenticated account with read access. The EPSS score is reported as less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting low current exploitation activity. Exploitation is straightforward: a user can simply click a reaction icon on a locked issue or issue the corresponding API call, and the system will accept it, bypassing the lock. While the attack does not lead to data compromise or system compromise, it erodes the intended lock behavior and could erode user trust in the issue‑locking process.