This vulnerability is a cross‑repository IDOR that allows an attacker to remove issue dependencies and add comments in private repositories that they are not authorized to view or modify. The flaw stems from missing authorization checks when processing issue dependency removal requests, giving an unauthenticated or minimally authenticated user the ability to tamper with objects in repositories they normally cannot access.

The issue affects the Gitea Open Source Git Server platform. No specific version information is provided, so all recent releases before the fix are potentially vulnerable.

Because the exploit requires crafting HTTP requests to the issue‑dependency removal endpoint, the attack vector is likely remote web. Exploitation is straightforward for an attacker who can send requests to a Gitea instance; the lack of a CEK suggests this is a high‑impact privilege escalation. No EPSS data is available and the vulnerability is not listed in KEV, so the likelihood for widespread exploitation is uncertain, but the impact on confidentiality and integrity is potentially severe.