A missing guard in Gitea’s Fork‑PR Actions task permits an attacker to read a third private repository through a collaborative‑owner branch. The flaw is a direct access‑control violation (CWE‑280 and CWE‑863), enabling the extraction of repository contents—code, configuration files, or other confidential data—without proper authentication.

All Gitea Open Source Git Server installations that use the affected Fork‑PR feature are vulnerable. According to the release notes that list the fix, versions released before 1.27.0 are considered at risk; this conclusion is inferred from the advisory statements and may not be explicitly stated in the vulnerability data.

The flaw can be exploited by triggering a Fork‑PR action that targets a repository having a collaborative‑owner branch. The CVSS base score of 7.1 indicates high severity, and because no EPSS score was supplied, the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits yet. Attackers who are collaborators or can trigger automated CI workflows that invoke the Fork‑PR task stand to gain read access to private code bases.