The vulnerability allows an attacker or a user with insufficient permissions to read or modify issue-template API endpoints because repository-unit authorization is not enforced. This missing check enables unauthorized access to issue templates, which could be used to inject malicious content or expose repository-specific information contained in those templates. The weakness is a Missing Authorization Check (CWE-862).

The Gitea Open Source Git Server versions up to and including 1.26.1 lack the required authorization on the issue-template API endpoints. Version 1.26.2 and later include the fix that enforces repository-unit authorization.

With a CVSS score of 4.3 the vulnerability is rated as moderate severity. An EPSS score of <1% indicates a very low probability that it will be actively exploited, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would need to send HTTP requests to the vulnerable issue-template endpoints, possibly using unauthenticated or low-privilege accounts, to gain unauthorized access.