Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked. This is a classic case of improper authorization, as defined by CWE-284.

Gitea, the self‑hosted Git platform. The affected versions are not listed in the advisory, so the flaw may exist in any version of Gitea that exposes the /api/v1/user/starred and /api/v1/user/times endpoints.

The CVSS score of 4.3 indicates moderate risk; the EPSS score is 0.00281, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, so public exploitation appears unlikely at present. The attack can be carried out by a logged‑in user who has had their access revoked, by simply issuing authenticated API requests to the above endpoints. Exposure depends on relationships or tracked‑time entries that were created before the revocation, so the data leaked is limited to what the user previously interacted with.