Gitea releases up to and including version 1.26.2 contain a flaw in the RSS and Atom feed endpoints that bypasses API access token scope checks. Because the endpoint does not verify that the token has the required repository scope, an attacker can use any token that lacks repository-level permissions to retrieve private commit data. This results in accidental leakage of confidential information from private repositories.

The vulnerability affects the Gitea Open Source Git Server. Specifically, all versions up to and including 1.26.2 are impacted. Later releases (1.26.3 and above) contain the fixed token‑scope enforcement for feed endpoints.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of < 1 % reflects a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Based on the description, the likely attack vector is remote network access: an adversary who possesses a valid API token that does not have repository scope can request the feed URLs from any reachable instance, thereby exposing private commit information. The low exploitation likelihood stems from the need to obtain a token, but internal users or compromised tokens present a feasible risk.