The flaw in Gitea allows an attacker to bypass authorization controls by supplying a user‑controlled key, resulting in incorrect assignment of permissions for critical resources. This bypass exposes sensitive repository information and can enable an unauthorized actor to gain broader access across the Git server. The weakness is captured by several common vulnerabilities: lack of proper authentication and authorization (CWE‑862), incorrect permission handling (CWE‑732), exposure of sensitive data (CWE‑200), and misuse of user‑controlled input (CWE‑639).

The vulnerability affects installations of the Gitea Open Source Git Server. Specific affected version ranges are not provided in the CVE data, so all deployments should review the vendor’s release notes for available fixes.

No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, yet its high impact indicates a serious risk. The likely attack vector is through API calls or key‑management interfaces that accept user‑controlled input, though no active exploitation has been reported at the time of this assessment. The severity of data exposure and privilege escalation warrants prompt attention.