The vulnerability is in the Gitea Notification API, which can return private issue metadata even after a user’s access has been revoked. The flaw allows an unauthorised party to view data that should have been protected, constituting an information disclosure vulnerability (CWE‑200).

All installations of the Gitea Open Source Git Server running a version earlier than 1.26.4 are affected when the Notification API is used. The issue is fixed in releases 1.26.4 and later.

The EPSS score is below 1 %, and the CVSS score of 7.5 indicates a high severity. It is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation. The attack likely requires the ability to send an HTTP request to the Notification API after a revocation event; this can be done remotely if the attacker can reach the server. Based on the HTTP access to the server. Although the probability of exploitation is modest, the information disclosed could assist in phishing, credential theft, or other secondary attacks, so the overall risk is considered moderate.