Gitea’s stopwatch API fails to re‑validate repository permissions after a user’s access is revoked. The flaw falls under CWE‑284, an access control weakness, and allows an attacker to see issue titles and repository names that are otherwise hidden in private repositories. The disclosed information can aid reconnaissance of internal projects and potentially expose sensitive project metadata. The vulnerability does not provide executable code or direct data exfiltration beyond these metadata fields.

All installations of the Gitea Open Source Git Server are potentially impacted. The specific product names and affected version ranges are not listed in the available data. Users should assume that any unpatched Gitea instance could be vulnerable until a fix is applied.

The CVSS score of 6.5 indicates a medium severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack vector requires an attacker to have previously authenticated and then to start a stopwatch before revocation or to use a previously started stopwatch that remains active after revocation. No additional external conditions are specified in the advisory, so the flaw appears to be exploitable only when an API call can be made to a repository that the user no longer owns access to.