The vulnerability causes the webhook authorization header, normally containing a secret token, to be returned by the Gitea API in plaintext. An attacker who can read the API response can capture the token and use it to authenticate webhook requests. The exposure undermines the confidentiality of the secret and could allow the attacker to impersonate the webhook service. There is no evidence that this flaw enables arbitrary code execution or other higher‑level privileges beyond misuse of the credential.

The affected product is the Gitea Open Source Git Server. All releases that continue to expose the authorization header in API responses are susceptible. The CVE data does not specify exact version ranges; however, the references to release 1.27.0 and a security advisory imply that the issue existed in versions preceding the advisory. No information indicates that the flaw has been fixed in any released version.

The flaw is an information‑exposure weakness (CWE‑200). The CVSS score of 2.7 indicates low overall risk. Exploitation requires access to the API endpoint that provides webhook data. Because the EPSS score is unavailable and the CVE is not listed in the CISA KEV catalog, the likelihood of exploitation in the wild is uncertain. Nevertheless, any party that can read the API will gain the token and could cause unauthorized webhook activity.