The vulnerability allows any holder of a public‑only personal access token to access web profile pages and RSS/Atom feeds for users and organizations marked as limited‑visibility. The token is authenticated via HTTP Basic, bypassing the token's restriction and exposing existence, profile metadata and public activity. Although no write privileges are granted, the disclosed data can aid an attacker in social engineering or profiling activities. This is a classic access‑control weakness, classified as CWE-1220.

The affected product is Gitea: Gitea. Specific compatible or affected versions are not supplied in the entry, so all releases prior to the 28.3.0 patch must be treated as potentially vulnerable.

Exploit requires only possession of a public‑only token; no privileged credentials are needed. An attacker can simply submit the token in an HTTP Basic header to the profile or feed URLs and retrieve the data. No known public exploits are listed and the EPSS score is unavailable, while the vulnerability is not in the CISA KEV catalog. The ease of exploitation and the lack of mitigation in older versions make the risk moderate to high for organizations relying on limited‑visibility settings.