A flaw in the OCI registry’s cross‑repository blob mount logic allowed a token that is supposed to grant only public package write access to also mount a private blob from a package accessible to the token owner. After mounting, the private blob becomes retrievable by anyone who can download the public package, exposing potentially sensitive container layers. This is an authorization bypass (CWE‑863), leading to confidential data leakage.

Gitea installations that have not yet applied version 28.3.0. Users running Gitea v28.2.x or earlier are potentially impacted; the advisory indicates that upgrading to v28.3.0 resolves the issue.

The vulnerability requires a public‑only token with the write:package scope and an owner who also has read permission on a private package. An attacker who can obtain or create such a token can perform a blob mount and thereafter anyone can download the private content via the public repository. While the EPSS score is not available, the lack of listing in CISA KEV does not preclude exploit; the mechanism is straightforward once the prerequisites are met.