An unauthenticated user can trigger the install guide’s go‑get meta endpoint to reveal whether a private repository exists, exposing information that should remain confidential. The weakness is an access control flaw, identified as CWE‑284, that allows unauthorized discovery of protected resources. The impact is that an attacker may use the information to target real or fictional repositories for further attacks, but no direct code execution or data leakage is disclosed by the current description.

The flaw affects the Gitea Open Source Git Server. Version information is not specified in the advisory, but the fix appears to be included in the v1.27.0 release, which is referenced in the vendor’s announcements.

The vulnerability can be exploited by issuing simple HTTP requests to the go‑get meta endpoint; no authentication or special privileges are required. The EPSS score is <1% and the CVSS score is 5.3, and the flaw is not listed in the CISA KEV catalog, suggesting that there is no publicly known exploitation but the risk remains high because the information is valuable. Given the lack of countermeasures in the public description, the risk to an organization that hosts private repositories is significant.