The vulnerability arises from the team‑repository linking API ignoring the RepoAdminChangeTeamAccess flag, allowing users to modify team access to repositories beyond their authorized scope. This enables an attacker who gains access to the endpoint, such as a user with repository management rights, to elevate privileges and grant themselves or other teams additional access to private repositories, thereby breaching confidentiality and integrity.

The affected product is the Gitea Open Source Git Server, as identified by the CNA vendor and product names. The CPE list is not provided, and the advisory does not specify vulnerable versions, so any installation using the team‑repository linking endpoint potentially is at risk until confirmed patch level. Administrators should specifically check for the presence of the RepoAdminChangeTeamAccess configuration and ensure it is enforced.

The CVSS score is not disclosed, and the EPSS score is unavailable, but the advisory notes that the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through authenticated API requests to the linking endpoint; realistic exploitation would require credentials with repository management privileges. Given the absence of a public exploitation payload, risk remains moderate until the issue is fixed.