The "/api/v1/admin" route group failed to enforce the public‑only restriction on personal access tokens. A public‑only token issued with admin scope by a site administrator could list private organizations, expose user email addresses, create organizations, obtain runner registration tokens, and even create new site administrator accounts that persist after the token is revoked. This constitutes an authorization bypass that permits attackers to gain privileged control and access sensitive data.

Any Gitea instance running a version earlier than 28.3.0 is affected. The fix was introduced in the 28.3.0 release. Gitea administrators using older versions should upgrade to 28.3.0 or later to remediate the issue.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. However the impact is significant because an attacker who obtains a public‑only token with admin scope can perform high‑impact actions such as creating administrators that survive token revocation. The vulnerability can be exploited by any entity that has the ability to claim or obtain such a privileged token from a site administrator, which is often an internal threat. Without a CVSS score or EPSS data, the exact severity and likelihood cannot be quantified, but the potential for privilege escalation and data exposure suggests a high risk.