The vulnerability exists in the RSS/Atom feed handlers of Gitea’s Open Source Git Server. It allows an attacker to bypass the scope restrictions imposed by API tokens and the public‑only confinement policy. As a result, credentials that are intended to grant limited access can be used to view or download content that should be private, leading to information disclosure or potential privilege escalation.

All Gitea Open Source Git Server deployments that had not yet applied the 1.27.0 release contain the flaw. The fix is included in the 1.27.0 release, but the advisory notes that the patch is incomplete, so earlier versions are affected.

The exploit hinged on sending a request to an RSS/Atom feed endpoint that is ordinarily accessed by users with authenticated API tokens. Because the scope check is bypassed, any host that can reach the feed URL—whether logged in or not—can retrieve private data. No exploitation code is required beyond standard HTTP requests, so an attacker merely needing network access to the server can exploit the flaw. The CVSS score is 4.3, indicating moderate severity. The EPSS score is < 1%, implying a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the classification as a scope bypass and the potential for wide exposure suggest a moderate risk for affected installations.