The vulnerability resides in Gitea’s Notification API which may return private issue metadata even after a user’s access rights have been revoked, representing an information‑disclosure flaw (CWE‑200). This unauthorized exposure could allow an attacker to view confidential details about issues, potentially facilitating phishing, credential theft, or other secondary attacks.

All installations of the Gitea Open Source Git Server that use the Notification API are potentially affected. The advisory notes that the flaw is fixed in release 1.26.4, so any deployment earlier than that version should check its version and upgrade if it is using the Notification API.

The EPSS score is below 1 % while the CVSS score of 7.5 indicates high severity. The likely attack vector requires the ability to send an authenticated HTTP request to the Notification API after a revocation event; this inference is based on typical API authentication requirements. Although exploitation probability is modest, the disclosed data could undermine confidentiality. The vulnerability is not listed in the CISA KEV catalog, so the overall risk is considered moderate to high for exposed data.