A weakness in Gitea’s access control logic allows metadata about private repositories to remain readable even after the repository’s access permissions have been revoked. The flaw is based on missing authorization checks (CWE‑862) and improper handling of sensitive data (CWE‑200), enabling an attacker to obtain repository details such as name, owner, and other configuration data that should only be visible to authorized users. Based on the description, it is inferred that the attacker can exploit this flaw by sending authenticated or unauthenticated requests to the exposed metadata endpoints, thereby gaining visibility into private repository information.

The issue affects Gitea Open Source Git Server versions released prior to the availability of the fix in the 1.27.0 release. All installations that rely on the default settings for revoking repository access are potentially vulnerable. Based on the description, it is inferred that these installations are at risk of leaking private repository metadata.

Because the vulnerability relies only on the ability to read publicly exposed metadata endpoints, it can be exploited remotely by an authenticated user who has had their access revoked or an unauthenticated user who can discover API endpoints. The likely attack vector is the use of known repository metadata URLs to request private repository information after revocation. The potential impact is the disclosure of repository metadata, which could aid further attacks such as phishing or credential harvesting. No current exploit has been observed in the wild (KEV: not listed) and the EPSS score is not available, suggesting the likelihood of widespread exploitation is low but not negligible.