The vulnerability allows an attacker to retrieve data from other repositories within the same organization through the organization-level Actions Run/Job APIs, leading to unintended exposure of project artifacts and metadata and violating confidentiality. The weakness is rooted in improper validation of repository context, identified by CWE-200 and CWE-863.

Affected systems are installations of Gitea Open Source Git Server, particularly older releases prior to the 1.27.0 release that include the fix. The issue is present in any deployment that exposes the organization-level Actions Run/Job API without proper isolation between repositories. Vendors listed: Gitea. No specific version list is provided; however, the 1.27.0 release notes and security advisory suggest that versions before this are vulnerable.

The EPSS score for this vulnerability is not available, and it is not listed in the CISA KEV catalog, indicating no known public exploitation but the risk of internal or privileged user misuse remains. Attackers can exploit the bug by making API calls that reference another repository's action data, provided they have access to the organization's API token or authenticated session. The CVSS score of 6.5 reflects moderate severity and confirms the seriousness of potential data leakage, and administrators should treat it as a confidentiality risk until patched.