The reported issue allows a user holding a public-only access token, which normally can access only public data, to delete all repositories belonging to a public organization through the API endpoint DELETE /api/v1/orgs/{org}/repos. The endpoint failed to enforce the public-only restriction, permitting the token to perform a privileged delete operation on private repositories. This elevates the token holder to a power that should be reserved for organization owners, compromising data integrity and availability by permanently removing private code and history.

This vulnerability affects the Gitea web application. All released versions prior to 28.3.0 are impacted because the bug fix was introduced in that release. Versions 28.3.0 and later include a check that rejects public-only tokens for organization‑owner routes.

The ability to delete repositories can be abused by any actor in possession of a public-only token granted to an organization owner. Exploitation requires only the possession of the token and can be carried out remotely via the exposed API, resulting in irreversible data loss. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the lack of a restriction on privileged API calls indicates a high severity risk. No public exploit has been reported at the time of this analysis.