The vulnerability allows an attacker to submit a personal access token over HTTP Basic authentication to the /{username} route without the system verifying the token's declared scope. A token that should be limited to unrelated scopes, such as read:issue, can therefore be used to read a user's private activity feed and profile activity tab. Tokens with only public permissions can enumerate a user's private repositories and organizations and even render private profile READMEs. Administrators' tokens can affect every account in the same way. Because the attack is performed via standard web requests over HTTP Basic authentication, an attacker only needs to possess any valid token and the target's username to exploit this flaw.

All Gitea installations running a version prior to the 28.3.0 release are vulnerable. The issue was corrected in release 28.3.0, which now limits token acceptance on the /{username} route to feeds that explicitly declare a read:user or read:organization scope. Site administrators should verify they are running V28.3.0 or later so that this enforcement is active.

The flaw has a high potential impact because it allows unauthorized reading of private data, but it does not provide any code execution or privilege escalation beyond the capabilities granted by the valid token. No published exploit code exists and the EPSS score is unavailable, yet the KEV catalog does not list this vulnerability, indicating it may not have been widely exploited yet. The attack vector is assumed to be over standard web requests; an attacker merely needs a user’s open‑API token and knowledge of the target username. Until the patch is applied, any user controlled or leaked token could be used to pull private activity data.