The internal HTTP client in Gitea is coded to always set InsecureSkipVerify:true, meaning it accepts any TLS certificate without verification. This flaw falls under CWE‑295 and effectively removes the cryptographic protections that validate server identities, allowing a man‑in‑the‑middle attacker to intercept or spoof data transmitted by Gitea to external services.

The vulnerability affects the Gitea Open Source Git Server. Specific version information is not provided in the CVE data; however, the issue is documented in the advisory for the 1.27.0 release and earlier versions that include the hardcoded setting.

The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, but the disablement of certificate verification is a highly severe flaw. The CVSS score of 7.5 indicates a medium-to-high severity. Attackers can potentially forge legitimate TLS connections or eavesdrop on data sent by Gitea to external hosts, compromising confidentiality. Exploitation requires network access to services invoked by the internal client; no privilege escalation is required beyond existing Gitea permissions.