A bypass of the personal access token scope enforcement allows a request to the repository home page (GET /{owner}/{repo}) to return private repository contents without a valid token. The weakness is a classic authorization bypass through a user-controlled key, classed as CWE‑863. When exploited, an attacker who knows or discovers a repository path can obtain the full file tree, code, and history of a private repository, exposing confidential data, trade secrets, or intellectual property.

The vulnerability affects the Gitea Open Source Git Server. Versions prior to the 1.27.0 release are likely vulnerable, as the issue was identified around the time of that release.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, yet the lack of any authentication requirement and the high potential impact imply a moderate to high exploitation risk. Attackers can use a simple HTTP GET request on an enumerated or guessed repository URL to retrieve private data, making effective exploitation straightforward once the target path is known.