The vulnerability in Gitea causes the issue timeline API and web interface to reveal cross‑reference information for 'dependency added' and 'dependency removed' events that point to issues the reader cannot normally view. When a readable issue is linked as a dependency to an issue in a private repository, the API returns the linked issue’s title, body, state, labels, poster and attachment names, and the web page shows the repository, number and title. This disclosure is despite the absence of any further permissions to that private issue, enabling users—including anonymous visitors—to access content that should be protected. The weakness is an information exposure (CWE‑200) compounded by a missing authorization check (CWE‑862).

All Gitea deployments running versions older than 28.3.0 are potentially affected. The fix was introduced in Gitea release 28.3.0, which removes the dependency events from the timeline unless the viewer has read permission to the referenced issue. Prior releases include 28.2.0, which addressed a related attachment metadata exposure but not this cross‑referencing flaw.

The flaw can be exploited by any actor who can read at least one issue in the repository, including anonymous users on a public issue that has a dependency link to a private issue. No additional configuration or privilege elevation is required beyond the ability to read the public issue. While no EPSS score or KEV listing is currently available, the potential for sensitive data leakage from a private issue through the API or web page represents a significant risk, especially for repositories with strict confidentiality requirements. Once the linked dependency data is exposed, an attacker gains a fuller picture of the private issue’s content without direct access to it.