The vulnerability arises from Gitea’s API and web issue‑search paths, which do not treat restricted user accounts as anonymous viewers when evaluating limited‑visibility repository owners. This improper access control flaw (CWE‑284) allows a restricted user to retrieve issue titles and bodies that should be hidden by the owner’s visibility policy. Keyword matching further discloses the presence of specific terms in hidden content, enabling an attacker to reconstruct sensitive discussion and gain unauthorized visibility into protected issues.

The affected product is Gitea, version(s) up to and including the release prior to 1.27.3. The vulnerability is specific to instances configured with restricted user accounts interacting with limited‑visibility repositories. Users managing Gitea installations with such configurations should verify the version they run.

The CVSS score of 4.3 suggests a moderate risk level. The EPSS score of less than 1% indicates a very low exploitation probability. The issue is not listed in CISA KEV. Based on the description, the likely attack vector is remote, as the vulnerability is accessed via public API and web interfaces. An attacker with a restricted account credential could exploit the flaw by querying the search endpoint to enumerate hidden issue content.