An attacker can manipulate repository visibility by using git push options, allowing an unauthorized change of a repository from private to public. Based on the description, the likely attack vector is the use of git push options with appropriate permissions to alter visibility settings.

Gitea Open Source Git Server is affected. The CVE data does not list specific version numbers, so all installed instances of Gitea should be treated as potentially vulnerable until a fixed release is applied.

The EPSS score is <1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 7.1, indicating a high severity impact. The attack requires the ability to push to a repository, implying that an authenticated user with push rights could abuse this flaw. Based on the description, the likely attack vector is an authenticated user exploiting push permissions to change visibility, but no exploitation data exists, so the risk is uncertain though the potential for exposing private code warrants immediate attention.