A bypass of the personal access token scope enforcement allows a request to the repository home page (GET /{owner}/{repo}) to return private repository contents without a valid token. The weakness is a classic authorization bypass through a user-controlled key, classed as CWE‑863. When exploited, an attacker who knows or discovers a repository path can obtain the full file tree, code, and history of a private repository, exposing confidential data, trade secrets, or intellectual property.

The vulnerability affects the Gitea Open Source Git Server. Versions prior to the 1.27.0 release are likely vulnerable, as the issue was identified around the time of that release.

The EPSS score is 0.00159 (<1%) and the vulnerability is not listed in CISA’s KEV catalog. Lack of any authentication requirement and the high potential impact imply a moderate to high exploitation risk, but the very low EPSS score indicates that exploitation is unlikely under normal circumstances. Attackers can use a simple HTTP GET request on an enumerated or guessed repository URL to retrieve private data, making effective exploitation straightforward once the target path is known.