The vulnerability arises from Gitea's notification API failing to re‑validate repository access when delivering notification details, allowing a user whose collaborator permission has been revoked to still view titles of issues and pull requests in private repositories. This exposure leaks internal project metadata, jeopardising confidentiality of development status and priorities. The weakness is a failure to enforce proper access control, classified as CWE‑200.

The affected product is the Gitea Open Source Git Server. No specific version ranges are listed in the advisory, but the fix is included in the 1.25.4 release.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. An attacker can exploit the flaw by accessing the notification endpoint after having been a collaborator, making the attacker only need a previously received notification, with no further privileges required.