A flaw in Gitea’s repository edit API causes a bug where the ClearRepoWatches patch is not applied to the EditRepo endpoint. When a repository is changed from public to private, the code path that handles the visibility change retains the old watch list instead of clearing it. This behavior can allow users who were watchers of the public repository to remain listed as watchers after the repository becomes private, potentially exposing private repository visibility or triggering unintended notifications.

The vulnerability affects the Gitea Open Source Git Server. No specific affected version range is listed in the CNA data, so any deployment prior to the fix may be vulnerable. The fix was included in the release of Gitea 1.27.0, which can be found in the referenced release notes.

The CVSS score is not provided and EPSS is unavailable, indicating that public exploitation data is sparse. The vulnerability is listed as not in the CISA KEV catalog. The likely attack vector is the API EditRepo path, which requires an authenticated request with repository edit privileges. An attacker who can alter a repository’s visibility could use this path to create scenarios where private repositories retain stale watcher entries, potentially leaking information about who had previously accessed the repository.