This vulnerability is a cross‑repository IDOR that allows an attacker to remove issue dependencies and add comments in private repositories that they are not authorized to view or modify. The flaw stems from missing authorization checks when processing issue‑dependency removal requests, giving an unauthenticated or minimally authenticated user the ability to tamper with objects in repositories they normally cannot access.

The issue affects the Gitea Open Source Git Server platform. No specific version information is provided, so all recent releases before the fix are potentially vulnerable.

Exploitation requires sending crafted HTTP requests to the issue‑dependency removal endpoint, implying a remote web attack vector. The missing authorization check allows an attacker who can reach the Gitea instance to remove issue dependencies and add comments in private repositories they are not authorized to modify. The CVSS score of 7.5 indicates high severity, and with an EPSS score of < 1% the likelihood of exploitation is low but not negligible. The vulnerability is not listed in the CISA KEV catalog. This flaw can lead to privilege escalation, allowing the attacker to tamper with data in private repositories, thereby compromising confidentiality and integrity.