A missing ownership check in Gitea allows a user who previously contributed to a repository to delete attachments from that repository after they have lost access to it. The deletion can be performed by sending a request in the context of another repository the user still can access, bypassing the intended restriction. Successful exploitation results in loss of data and can be used to remove evidence or tamper with the repository history. The weakness is a classic example of insufficient authorization controls (CWE‑284).

The vulnerability affects Gitea, the open‑source Git hosting platform. All versions prior to the release of 1.25.4 are impacted, as the issue was fixed in that update. No version matrix is provided in the advisory, but it is understood that any Gitea instance using an older release is at risk.

The CVSS score of 7.5 classifies the issue as high severity. The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can authenticate to a repository they no longer own, and who also have access to a different repository, may craft a deletion request that targets the former repository’s attachments. No special hardware or complex prerequisites are required; the flaw exploits a logical oversight in the permission checks that enables the cross‑repository deletion.