This vulnerability allows a user with a public-only delegated token to create a private repository and initiate a migration task through Gitea's migration API. The API mistakenly accepts the token when the request specifies a private repository, bypassing the authorization check that normally blocks such operations. An attacker possessing a public token can therefore create private repositories under an account or organization that grants permission to the token holder, escalating privileges and potentially exposing confidential data to the attacker.

This vulnerability concerns the repository migration service in Gitea; the CVE payload does not specify affected product versions.

With a CVSS score of 5.4, the vulnerability carries a moderate severity. EPSS data is not available, so the likelihood of exploitation is unclear, and the vulnerability has not been listed in the CISA KEV catalog. The attack vector is a standard HTTP API call to the migration endpoint, requiring an authenticated public-only token that holds appropriate organizational or account permissions. Successful exploitation results in the unauthorised creation of private repositories, providing the attacker with persistence and covert data storage capabilities.