An attacker can manipulate repository visibility by using git push options, allowing an unauthorized change of a repository from private to public. This flaw permits the attacker to expose sensitive code and data without proper authorization, constituting a privilege escalation issue tied to insecure permission handling.

Gitea Open Source Git Server is affected. The CVE data does not list specific version numbers, so all installed instances of Gitea should be treated as potentially vulnerable until a fixed release is applied.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. No CVSS score is provided, so severity cannot be quantified. The attack requires the ability to push to a repository, implying that an authenticated user with push rights could abuse this flaw. Because no exploitation data exists, the risk is uncertain though the potential for exposing private code warrants immediate attention.