Gitea fails to validate the ownership of repositories when an attachment is linked to a release. As a result, an attachment that has been uploaded to a private repository can be referenced by a release in another repository, including public ones. This flaw constitutes a cross‑repository authorization bypass (CWE‑284) that allows an attacker to obtain access to confidential data by executing the bypass. The disclosed content can be viewed or downloaded by anyone who has read access to the target public repository, thereby violating confidentiality and potentially exposing sensitive files.

The vulnerability affects the Gitea Open Source Git Server. No specific version range is listed in the advisory, but the fix is included in release 1.25.4 and newer. All earlier releases that still allow private repositories to link attachments to releases are considered vulnerable.

The vulnerability carries a CVSS score of 9.1, indicating critical severity. The EPSS score is below 1 percent, implying that, while the exploit likelihood is low, the potential damage is considerable. The flaw is not listed in the CISA KEV catalog. The attack can be carried out by an attacker who can upload an attachment to a private repository and then edit a release in a public repository to reference that attachment. The required conditions are minimal, making the attack plausible, especially in environments where privacy boundaries between repositories are not tightly enforced.