The vulnerability allows a board to list pull requests that reference issues on the board without verifying whether a viewer is authorized to view the pull requests. As a result, when a private pull request mentions an issue on a publicly visible board, the board reveals the private repository path, pull request number, title, and state to anonymous visitors. The body, diffs, and files are not exposed, but the disclosed metadata can aid an attacker in identifying private repositories and pull requests that could be targeted for further exploitation. The weakness is a broken access control flaw as defined by CWE-862.

Affected systems are installations of Gitea, regardless of version, that have project boards enabled and contain private pull requests linked to issues on those boards. The problem is fixed in Gitea release 28.3.0 and later. Versions prior to 28.3.0 running with public boards that reference private repositories are therefore vulnerable.

EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog. The loss of confidentiality is confined to pull request metadata, and no code execution is possible. An attacker would need to interact with a public project board that includes a private pull request referencing an issue. Because the disclosure does not provide direct access to repository contents, the immediate risk to system integrity is limited, but the information obtained could accelerate reconnaissance and planning of targeted attacks. The CVSS score is not provided, and no widespread exploitation is documented, suggesting a moderate impact for organizations that rely on strict separation of private data.