GET /api/v1/user/subscriptions exposed the metadata of all repositories a user was watching, including private ones, without verifying current access rights. This allowed a user who had previously accessed a private repository but later lost permissions to retrieve its name, description, clone URLs, owner, and activity counters. The flaw is a classic information‑disclosure vulnerability caused by missing permission checks (CWE‑862).

The vulnerability affects installations of the Gitea platform before the fix introduced in Gitea 1.27.0 and 28.0.0. Versions released before 28.0.0 remain vulnerable if they have not been updated.

An attacker who authenticates as the affected user can issue the vulnerable API request to obtain potentially sensitive metadata about repositories they no longer own or have access to. The exploit requires only legitimate authentication and is performed via the standard HTTP GET action on the subscriptions endpoint. The advisory lists a CVSS score of 4.3 and an EPSS score of < 1%, and the vulnerability is not catalogued in the CISA KEV list, suggesting that public exploitation data is currently limited. Nonetheless, disclosure of private repository metadata poses a confidentiality risk and could aid further attacks if combined with other information.