The vulnerability allows an attacker to increase the permissions associated with an existing access token used in the Gitea API. By manipulating the token scope, the attacker can obtain privileges above those intended for the token, potentially leading to unauthorized access to repository data, configuration settings, or administrative actions. This flaw is classified as CWE-266 and CWE-284, improper authorization control, and is an example of a privilege escalation vulnerability.

The weakness affects Gitea, the open source Git server. All installations that incorporate the vulnerable API handling are potentially impacted; the specific affected software versions are not listed in the advisory. Users should verify whether they are running a vulnerable version, especially those older than the public release noted in the references.

The CVSS score of 9.8 indicates a high severity risk, while the EPSS score remains at less than 1%. Because the flaw involves token scope manipulation through the API, the attacker must have access to a valid access token, which may be provided via compromised credentials or misconfigured token permissions. The exploitation does not require additional user interaction beyond API usage, so it could be performed remotely by anyone who can authenticate to the server. The vulnerability is not listed in the CISA KEV catalog, but any environment that relies on the affected Gitea API should consider it a high‑risk exposure until a patch is applied.