A flaw in Gitea’s organization and permission endpoints permits unauthorized users to view or obtain personal access tokens that are intended to be visible only to the token owner. This weakness enables an attacker to use those tokens to access repositories or perform actions otherwise forbidden, constituting an authorization bypass. The vulnerability is categorized as CWE‑284 (Improper Authorization) and CWE‑1259 (Unrestricted Use of Personal Access Tokens).

The flaw is present in the Gitea Open Source Git Server, and the vendor’s release notes indicate that version 1.27.0 includes the fix. While the precise list of vulnerable versions is not enumerated, any version earlier than 1.27.0 that has not yet been patched may be affected.

No EPSS score has been provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is either not yet observed or not considered a high priority. However, the description implies that an attacker can send crafted requests to the organization and permission API endpoints to retrieve personal access tokens. This inference indicates that the attack path may be relatively straightforward for authenticated users with API access or for anonymous users if the endpoints are publicly exposed. Due to the lack of a CVSS score, the exact severity cannot be quantified, but authorization bypass typically carries a high potential impact if successful.