A public‑only authentication token, intended to restrict access to only public resources, can be used by owners of limited‑visibility repositories and packages to gain access to private data. This flaw undermines the intended authorization model and exposes repository or package contents that should remain private to the owner. The weakness is an example of insufficient authorization, matching CWE‑863.

All installations of the Gitea Open Source Git Server that are using versions released before the 1.27.0 update are affected. The specific version range is not provided, but the issue is a residual problem described after CVE‑2026‑25714 and addressed in the 1.27.0 release.

The CVSS score of 9.6 and the EPSS score of < 1% indicate a high severity but low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw affords an attacker with a limited‑visibility owner account the ability to access private repository or package data by leveraging a public‑only token. The attack requires the attacker to obtain or create such a token through the normal token creation interface, making the vulnerability exploitable via authenticated interface interactions. The lack of publicly known exploit code and the absence of require‑additional authentications or privileges mitigate immediate exploitation risk, but the impact of successful exploitation is high due to potential data exposure.