The vulnerability permits a user with write access to a repository to delete Git LFS locks that belong to other repositories, effectively bypassing repository ownership checks. This results in unauthorized modification of lock state, which can disrupt collaboration, compromise the integrity of the project history, and facilitate further attacks such as arbitrary code execution within the repository. The weakness is classified as CWE-284 (Improper Authorization) and CWE-639 (Privilege Escalation through Privilege Validation Errors).

The flaw affects installations of the Gitea open source Git server. No specific version range is listed in the CNA data; however, the advisory references the release of v1.25.4, which contains the fix, indicating that earlier releases are vulnerable. No other vendors or products are explicitly mentioned.

With a CVSS base score of 9.1, the severity is high. The EPSS score is less than 1%, suggesting that the likelihood of exploitation in the wild is low at this moment, and the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation requires only authenticated access with write permission to a repository; the attack path is via standard HTTP API calls to delete locks, with no additional privilege escalation needed. The attack vector is inferred to be remote access over the web interface or API.