The vulnerability lies in Gitea's organization repository‑creation API, which accepts a token with write:organization scope even when the token lacks the required write:repository scope used by other repository‑creation routes. An attacker holding a personal access token or OAuth application token limited to organization scopes can therefore create new repositories that are owned by an organization. This bypasses the token’s delegated scope boundary while still obeying the user’s organizational permissions, enabling unauthorized repository creation.

The affected product is Gitea. The issue is present in versions prior to 1.27.3; the patch in release 1.27.3 removes the incorrect scope validation.

The vulnerability carries a CVSS score of 5.4, indicating a moderate impact. The EPSS score is <1%, indicating a very low but non‑zero exploitation probability. It is not included in the CISA KEV catalog. The vulnerability requires an authenticated API request with a token that has write:organization access; it does not involve unauthenticated access or network traversal. An attacker who can obtain such a token – by phishing, credential compromise, or other means – can use the organization‑repository creation endpoint to add organization repositories, potentially for malicious code deployment or data exfiltration.