This vulnerability, identified as CWE‑863, is a broken access control flaw that allows an attacker with a public API token to invoke team endpoints that should be restricted to privileged users. Because the public‑only token restriction is not enforced on these routes, an attacker can modify team membership or configuration, effectively elevating privileges within the Git server.

Gitea Open Source Git Server is affected. All installations using a version released before the 1.27.0 update, which added the enforcement check, remain vulnerable. The product is commonly deployed in self‑hosted Git environments.

The CVE does not have an EPSS score and is not listed in the CISA KEV catalog, yet the classification as CWE‑863 indicates a broken access control flaw that can directly lead to privilege escalation. If public tokens exist and team API routes are exposed, an attacker could manipulate team settings or insert malicious code. The exploitation probability is contingent on the presence of public tokens and the exposure of the relevant endpoints.