The vulnerability allows a user with write access to a project in one organization to alter projects belonging to another organization by exploiting insufficient ownership checks. This is a CWE-284 authorization flaw that results in unauthorized modification of configuration and metadata of foreign projects, compromising integrity and potentially confidentiality of project data.

The affected product is Gitea Open Source Git Server. Users running any version of Gitea before the security release that includes the fix are vulnerable. No specific version range is provided in the CNA data, but the fix is publicly available in the release notes for version 1.25.4.

The vulnerability carries a high severity CVSS score of 9.1 and a very low EPSS probability of less than 1%, indicating that while the risk to a system is significant, widespread exploitation is unlikely at present. The issue is not listed in the CISA KEV catalog. An attacker must already have project-level write permission in one organization; through the IDOR flaw, they can target another organization's projects by manipulating the project identifier in API requests.