This vulnerability allows a user who possesses a public‑only repository token to push commits that modify the head branch of a private pull request. Because the token is not restricted by repository scope, the attacker can alter code that is slated for review in a private repository. The weakness is a failure of authorization enforcement at the token level and is classified as Wrong or Incomplete Authorization (CWE‑863). The potential impact is the injection of malicious code into branches prior to review, thereby compromising the integrity and confidentiality of the repository.

Gitea Open Source Git Server is impacted. No specific version information is provided in the available data, so the precise set of vulnerable releases cannot be stated.

No EPSS score or KEV listing is available for this issue, and the CVSS score is not published. The attack requires only possession of a public‑only token, which can be generated by any account that is allowed to create such tokens. As a result, the vulnerability has a high potential impact for any organization using public‑only tokens in private repositories and can be exploited without additional network or user interaction vulnerabilities.